Which versions of Jwt Attack are affected by CVE-2026-14837?

A privilege escalation vulnerability in Lenze C430, C520, C550, and i950 series industrial control devices could allow low-privileged local attackers to bypass SSH signature verification and gain…. A patch is available.

How to fix or mitigate CVE-2026-14837?

Within 24 hours: Isolate affected devices from production networks and restrict physical access to authorized personnel only. Disable SSH on devices where not operationally required. Within 7 days: Implement strict network segmentation for control system networks, enforce application whitelisting, and enable detailed logging of authentication events. Within 30 days: Monitor Lenze’s security advisories for patch availability; consider deploying additional monitoring for anomalous local access attempts and review vendor guidance for interim hardening measures.

Jwt Attack CVE-2026-14837

Q: What is the CVSS score of CVE-2026-14837?

CVE-2026-14837 has a CVSS 4.0 base score of 8.5 (High). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-49115 HIGH

Improper Verification of Cryptographic Signature (CWE-347)

2026-07-27 CERTVDE

GHSA-fcw6-hwx8-wwx8

Authentication Bypass Jwt Attack C430 C520 C550 I950 Gena I950 Genb

8.5

CVSS 4.0 · Vendor: CERTVDE

Severity by source

Vendor (CERTVDE) PRIMARY

8.5 HIGH

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (CERTVDE) · only source for this CVE.

CVSS VectorVendor: CERTVDE

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 27, 2026 - 09:01 EUVD

Analysis Generated

Jul 27, 2026 - 08:21 vuln.today

CVE Published

Jul 27, 2026 - 07:03 cve.org

HIGH 8.5

DescriptionCVE.org

Multiple Lenze products are affected by an improper signature verification vulnerability in the SSH enablement mechanism. A low-privileged local attacker can bypass verification of the SSH enable file signature and enable SSH access on the device. Successful exploitation may result in unauthorized administrative access and complete system compromise.

AnalysisAI

Privilege escalation in Lenze C430, C520, C550, and i950 series devices allows low-privileged local attackers to bypass SSH enablement signature verification. This enables unauthorized SSH access, leading to complete system compromise. The vulnerability is tracked under CVE-2026-14837 and was reported by CERTVDE; no public exploit or active exploitation (KEV) has been confirmed at this time.