UNIVERGE IX-R/IX-V CVE-2026-16876

Exploitation requires that the device's WebGUI management interface be reachable by the attacker - the description explicitly states the attack is performed 'via internet,' so an internet-exposed or otherwise network-reachable WebGUI is the key prerequisite. Given AV:N/AC:L/PR:N/UI:N, no authentication, no user interaction, and no special client-side conditions are needed once the WebGUI is reachable; the attacker only needs to tamper with WebGUI messages. The primary limiting factor is network exposure: deployments where the WebGUI is confined to an isolated management network are not remotely exploitable by external attackers.

The signals are consistent and point to genuine high priority: the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) indicates a network-reachable, low-complexity attack requiring no privileges and no user interaction, with high confidentiality and integrity impact (VC:H/VI:H) and low availability impact (VA:L). CWE-306 combined with arbitrary CLI command execution means an attacker effectively controls the device. There is no EPSS score, KEV listing, or public POC provided in the input, so this is not confirmed as actively exploited - the risk is driven by exploitability characteristics rather than observed attacks. The description explicitly notes exposure 'via internet,' so any operator whose IX-R/IX-V management interface is internet-facing should treat patching as urgent regardless of organization size.

An attacker scans for internet-exposed UNIVERGE IX-R/IX-V WebGUI interfaces, then crafts or tampers with a WebGUI request message that maps to a privileged CLI command and sends it directly to the device without logging in. Because the interface fails to authenticate the request (CWE-306), the router executes the command, letting the attacker alter routing/configuration or read sensitive settings. No public POC is identified at time of analysis, but the low attack complexity makes reliable exploitation plausible.