Intelbras SG 2404 CVE-2026-124577

Exploitation requires network reachability to the device's Web Management Interface and specifically the /EXCU_SHELL endpoint on an Intelbras SG 2404 PoE L2+ switch running firmware 1.00.70 or 1.00.72; per the CVSS vector (PR:N/UI:N/AC:L/AT:N) no credentials, user interaction, or special timing are needed against those versions. The primary limiting factor is exposure of the management interface: these switch admin interfaces are typically intended to sit on an internal or dedicated management VLAN, so real-world risk is highest where that interface is reachable from attacker-controlled networks or the internet. Firmware 1.00.74 removes the flaw, so patched devices are not exploitable.

Multiple signals converge on genuine priority. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a remotely reachable, low-complexity flaw needing no authentication, no user interaction, and no special attack requirement, with full high impact to confidentiality, integrity, and availability (VC:H/VI:H/VA:H) - consistent with an authentication bypass (CWE-287) that hands an attacker control of the device. Exploit maturity is E:P (Proof-of-Concept), and the description states an exploit has been made public, so a working-exploit capability is at least demonstrated rather than theoretical. The vuln.today Decision label is 'this_week' (not act_now/emergency), indicating prompt remediation rather than drop-everything urgency. Key signals are MISSING: there is no EPSS probability in the input and the CVE is NOT listed in CISA KEV, so there is no confirmation of active, widespread exploitation despite public exploit availability. All intelligence traces to a single reporter (VulDB/EUVD mirror); there is no independent Intelbras advisory in the references, so affected/fixed versions rest on VulDB's claim alone. Net: a credibly high-severity, low-barrier auth bypass with public PoC, tempered by a regionally niche product and the absence of KEV/EPSS corroboration - treat as a real near-term fix, not a confirmed mass-exploitation emergency.

An attacker with network reach to the switch's Web Management Interface sends a crafted request to the /EXCU_SHELL endpoint to bypass authentication and gain administrative control of the SG 2404 PoE L2+ switch, altering configuration or disrupting the network. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, no credentials, local access, or victim interaction are required. A public exploit is reported available (VulDB) with CVSS exploit maturity E:P, lowering the skill needed to reproduce the attack.