EUVD-2026-41051
GHSA-296j-g5j7-v64q
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Network-accessible web interface (AV:N), no complexity (AC:L), requires Service or Admin role (PR:L), partial confidentiality only for SNMP keys (C:L), no integrity or availability impact.
Primary rating from Vendor (sba-research).
CVSS VectorVendor: sba-research
Lifecycle Timeline
1DescriptionCVE.org
The genucenter web interface before version 8.0p11 unnecessarily exposes sensitive SNMP authentication and encryption keys in its HTTP responses to users with the “Service” or “Admin” role.
AnalysisAI
The genucenter web interface by genua exposes SNMP authentication and encryption keys in cleartext HTTP responses to any user holding the 'Service' or 'Admin' role, enabling credential theft without any exploitation complexity beyond normal authenticated use. Affected versions are all releases prior to 8.0p11; the fix was disclosed by sba-research via a coordinated advisory in April 2026. No public exploit code or active exploitation has been identified at time of analysis, though the disclosure of SNMP v3 keys - which govern both authentication integrity and traffic encryption - represents a meaningful lateral movement risk if those keys are reused across network devices.
Technical ContextAI
genucenter is a centralized security management web interface produced by genua, a German network security vendor. The affected CPE is cpe:2.3:a:genua:genucenter:*:*:*:*:*:*:*:*, covering all versions before 8.0p11. SNMP v3 credentials consist of two distinct key types: an authentication key (typically HMAC-MD5 or HMAC-SHA) that proves message integrity, and an encryption key (typically AES-128 or DES) that protects confidentiality of SNMP traffic. The root cause is CWE-201 (Insertion of Sensitive Information Into Sent Data), meaning the server actively includes these credentials in its HTTP responses rather than filtering them prior to transmission - a design flaw distinct from incidental leakage. Any user who can authenticate to the genucenter web console with Service or Admin privileges can retrieve these keys simply by observing normal HTTP traffic, without triggering any anomalous behavior.
RemediationAI
The primary fix is upgrading genucenter to version 8.0p11 or later, which resolves the unnecessary inclusion of SNMP credentials in HTTP responses. As a compensating control prior to patching, organizations should audit which accounts hold the 'Service' or 'Admin' role and revoke unnecessary assignments, reducing the pool of users who can access the leaking responses. Additionally, rotate all SNMP authentication and encryption keys immediately after patching, as any keys that were accessible through the vulnerable interface should be considered compromised. If SNMP keys are shared across devices, prioritize rotating those keys on the highest-value network equipment first. Restricting web interface access to a dedicated management VLAN limits exposure but does not eliminate the vulnerability for legitimate users. Advisory details are available at https://github.com/sbaresearch/advisories/tree/public/2026/SBA-ADV-20260424-01_Genucenter_Disclosure_of_SNMP_Credentials.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today