Which versions of Avation Light Engine Pro are affected by CVE-2026-1341?

Avation Light Engine Pro (CVE-2026-1341) contains a critical authentication bypass that exposes its full configuration and control interface to any network-connected attacker, allowing remote…

How to fix or mitigate CVE-2026-1341?

Within 24 hours, identify all Avation Light Engine Pro instances in your OT environment and isolate them on protected network segments if operationally feasible. Over the next 7 days, implement firewall rules restricting device access to authorized management stations only, disable remote management interfaces where possible, and configure comprehensive logging and alerting for all configuration changes. Within 30 days, establish vendor contact for patch status and timeline, complete a risk assessment for each deployed instance, and evaluate replacement products with authentication controls built-in, with formal risk acceptance or remediation deadline documented to business stakeholders.

Avation Light Engine Pro CVE-2026-1341

Q: What is the CVSS score of CVE-2026-1341?

CVE-2026-1341 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

CRITICAL

Missing Authentication for Critical Function (CWE-306)

2026-02-03 ics-cert@hq.dhs.gov

Authentication Bypass

9.3

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.8 CRITICAL

Interface is remotely reachable with no authentication or user interaction (AV:N/AC:L/PR:N/UI:N), granting full read and control over the device, so C/I/A are all High.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Jun 04, 2026 - 21:22 NVD

9.3 (CRITICAL)

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

CVE Published

Feb 03, 2026 - 22:16 nvd

N/A

CVE Published

Feb 03, 2026 - 22:16 cve.org

CRITICAL 9.3

DescriptionCVE.org

Avation Light Engine Pro exposes its configuration and control interface without any authentication or access control.

AnalysisAI

Missing authentication in Avation Light Engine Pro exposes its full configuration and control interface to any remote party with network reach, allowing unauthenticated attackers to read settings and manipulate the device's operation. Tracked as CWE-306 with a CVSS 4.0 score of 9.3, it was reported through CISA's ICS-CERT (advisory ICSA-26-034-02), indicating an OT/ICS deployment context. There is no public exploit identified at time of analysis, and the EPSS probability is very low (0.02%, 6th percentile).

Technical ContextAI

Avation Light Engine Pro is a lighting/AV control product (Avation is a New Zealand vendor) whose management and control interface is reachable over the network. The root cause is CWE-306 (Missing Authentication for Critical Function): a security-sensitive function - here the configuration and control plane - is exposed with no authentication or access-control gate in front of it. Rather than a memory-safety or injection bug, this is a design/deployment flaw where the trust boundary is simply absent, so any actor who can route packets to the interface is treated as an authorized operator. No CPE strings were provided in the source data, so exact affected build identifiers are not enumerable from CPE alone; the affected component is identified by product name via the CISA/CSAF advisory.

Affected ProductsAI

The affected product is Avation Light Engine Pro (vendor Avation, https://avation.co.nz/contact-us/). No specific version range or CPE string was provided in the source intelligence, so precise affected builds are not confirmed from the available data; consult the CISA ICS advisory ICSA-26-034-02 (https://www.cisa.gov/news-events/ics-advisories/icsa-26-034-02) and the associated CSAF document (https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-034-02.json) for the authoritative affected-version list. A corresponding entry also exists at VulDB (https://vuldb.com/vuln/344220).

RemediationAI

No exact vendor-released fix version is identified in the available data, so treat the CISA ICS advisory ICSA-26-034-02 (https://www.cisa.gov/news-events/ics-advisories/icsa-26-034-02) as the authoritative source for patch or firmware guidance and contact the vendor directly (https://avation.co.nz/contact-us/) to confirm a fixed release. As the primary compensating control, remove the control/configuration interface from any untrusted network: place the device on an isolated OT/management VLAN and block inbound access to its management port(s) at the perimeter and internal firewalls, which prevents remote reach at the cost of requiring on-network or jump-host access for legitimate administration. Where the platform permits, place a reverse proxy or network access-control layer requiring authentication in front of the interface, and restrict source addresses to a known management allowlist; note this adds an external auth layer but does not fix the underlying missing-auth flaw. Monitor the interface for unexpected configuration changes until a vendor patch is confirmed.