CVE-2026-1223

MediumCVSS 4.9/10Last modified Jun 17, 2026

Description

PrismX MX100 AP controller developed by BROWAN COMMUNICATIONS has an Insufficiently Protected Credentials vulnerability, allowing privileged remote attackers to allowing authenticated remote attackers to obtain SMTP plaintext passwords through the web frontend.

Metrics

CVSS 3.1 4.9/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-522

Affected software

VendorProductVersions
BROWAN COMMUNICATIONSPrismX MX100 AP controller< 1.03.23.01

References

Timeline

Published
Jan 20, 2026
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-122306.4The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Stored Cross-Site Scripting vCVE-2026-122300Missing Authorization vulnerability in Apache Roller 4.0 through 6.1.6 allows a weblog member with the Limited role to remove or change entrCVE-2026-1223013.1Parse Server before 8.6.114 and 9.0.0 before 9.10.6-alpha.6 returns field values in object create responses to callers that lack read accessCVE-2026-1223029.8Kyverno before 1.19.2 contains a privilege escalation vulnerability that allows namespace admins to create resources beyond their RBAC becauCVE-2026-1223039.9Kyverno from 1.17.0 before 1.19.2 contains an authorization bypass vulnerability that allows namespace tenants to overwrite resources in othCVE-2026-1223049.9Kyverno from 1.17.0 before 1.19.2 contains an authorization bypass vulnerability that allows namespace admins to escape namespace confinemenCVE-2026-1223057.7Kyverno before 1.19.2 contains a denial of service vulnerability in substituteVariablesIfAny that allows low-privileged users to hang the adCVE-2026-1223067.7Kyverno before 1.19.2 contains a denial of service vulnerability that allows namespaced policy authors to exhaust admission controller CPU bCVE-2026-1223077.7Kyverno before 1.19.2 contains a policy bypass vulnerability in the admissionpolicygenerator controller, which folds PolicyExceptions into gCVE-2026-1223088.5Kyverno before 1.19.2 contains an authorization bypass vulnerability in the Generation Handler that allows users with create/update permissiCVE-2026-1223096.2Kyverno before 1.19.2 contains a denial of service vulnerability that allows namespace-scoped policy authors to exhaust CPU and memory by suCVE-2026-122316.4The Exclusive Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘ exad_infobox_image’ parameter
CVE-2026-1223: Medium severity, CVSS 4.9 | Vulnix