CVE-2026-3356

CriticalCVSS 9.3/10Last modified Jul 24, 2026

Description

The MS27102A Remote Spectrum Monitor is vulnerable to an authentication bypass that allows unauthorized users to access and manipulate its management interface. Because the device provides no mechanism to enable or configure authentication, the issue is inherent to its design rather than a deployment error.

Metrics

CVSS 4.0 9.3/10CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-306

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
AnritsuRemote Spectrum Monitor MS27100AAll versions
AnritsuRemote Spectrum Monitor MS27101AAll versions
AnritsuRemote Spectrum Monitor MS27102AAll versions
AnritsuRemote Spectrum Monitor MS27103AAll versions

References

Timeline

Published
Mar 31, 2026
Last modified
Jul 24, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-335608.8The DMP-5000 file service exposes authenticated arbitrary file upload functionality. There are exposed endpoints which allows authenticated CVE-2026-335634.8Exposure of sensitive information to an unauthorized actor for some Intel(R) Platform Monitoring Technology (Intel(R) PMT) software before vCVE-2026-335653.3in OpenHarmony v6.0 and prior versions allow a local attacker cause DOS.CVE-2026-335665.1There is a cypher injection issue in LogonTracer prior to v2.0.0. If specially crafted Windows event log data is loaded, the contents of theCVE-2026-335675.4Improper input validation for the Intel(R) VTune(TM) Profiler software within Ring 3: User Applications may allow an escalation of privilegeCVE-2026-335689.1A OS command injection vulnerability exists in the boa formMapDelDevice macstr functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.CVE-2026-335696.5Anviz CX2 Lite and CX7 administrative sessions occur over HTTP, enabling on‑path attackers to sniff credentials and session data, which canCVE-2026-33578.8IBM Langflow Desktop 1.6.0 through 1.8.2 Langflow could allow an authenticated user to execute arbitrary code on the system, caused by an inCVE-2026-335705.7PowerSYSTEM Center REST API endpoint for devices allows a low privilege authenticated user to access information normally limited by operatiCVE-2026-335716.9Out-of-bounds read for the Intel(R) VTune(TM) Profiler software before version 2026.0.0 within Ring 1: Device Drivers may allow a denial of CVE-2026-335725.5OpenClaw before 2026.2.17 creates session transcript JSONL files with overly broad default permissions, allowing local users to read transcrCVE-2026-335738.8OpenClaw before 2026.3.11 contains an authorization bypass vulnerability in the gateway agent RPC that allows authenticated operators with o