CVE-2026-22101

MediumCVSS 5.1/10Last modified Oct 19, 2026

Description

The access to the service menu is obfuscated, but possible with only physical access. This menu exposes sensitive information such as serial numbers, MAC addresses, and WiFi network and password.

Metrics

CVSS 4.0 5.1/10CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-200

Affected software

No affected versions have been published.

Timeline

Published
Sep 29, 2026
Last modified
Oct 19, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-221029.3A POST request sent to a specific webserver endpoint can be used to write to arbitrary file locations. The endpoint accepts the filename parCVE-2026-221039.3The NPC start endpoint on the web server at port 8090 is vulnerable to command injection.CVE-2026-221047.1Improper access control in Hashtopolis server web-interface chunk activity component for versions prior to 0.14.8 allows any created accountCVE-2026-221058.7Delta UFC500 charging stations derive the default credentials of the Service account from character positions of the device serial number. ACVE-2026-221098.4The shipped WebUI template database retains the factory default passwords for all five account types in cleartext. Defaults are identical acCVE-2026-22119.8A vulnerability was determined in code-projects Online Music Site 1.0. Affected is an unknown function of the file /Administrator/PHP/AdminDCVE-2026-221108.7The web server does not check authentication on POST or PUT. An unauthenticated attacker can reboot the charger; by brute-forcing the configCVE-2026-221145.3HTTP basic auth enforces no retry limit or backoff. Combined with the default service password, the keyspace is exhaustible.CVE-2026-22129.8A vulnerability was identified in code-projects Online Music Site 1.0. Affected by this vulnerability is an unknown functionality of the filCVE-2026-22137.2A security flaw has been discovered in code-projects Online Music Site 1.0. Affected by this issue is some unknown functionality of the fileCVE-2026-22144.8A weakness has been identified in code-projects for Plugin 1.0. This affects an unknown part of the file /Administrator/PHP/AdminAddAlbum.phCVE-2026-22153.7A vulnerability was detected in rachelos WeRSS we-mp-rss up to 1.4.8. This issue affects some unknown processing of the file core/auth.py of