Which versions of Aclara Metrum are affected by CVE-2026-1840?

The Aclara Metrum Cellular Web Interface, used in Hubbell/Aclara's smart-grid metering modules, allows unauthenticated remote attackers to reach critical device functions including forced restarts…. A patch is available.

How to fix or mitigate CVE-2026-1840?

Within 24 hours: Inventory all Aclara Metrum Cellular devices and restrict network access to the web interface via firewall rules. Within 7 days: Implement network segmentation to isolate affected devices to essential paths only; enable detailed logging on access attempts. Within 30 days: Subscribe to Hubbell/Aclara security advisories for patch releases; develop and validate a device replacement or firmware update strategy.

Aclara Metrum CVE-2026-1840

Q: What is the CVSS score of CVE-2026-1840?

CVE-2026-1840 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.7%.

EUVD-2026-39058 HIGH

Missing Authentication for Critical Function (CWE-306)

2026-06-24 icscert

GHSA-gx8p-xc64-fg2f

Authentication Bypass Aclara Metrum Cellular Web Interface

8.7

CVSS 4.0 · Vendor: icscert

Severity by source

Vendor (icscert) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.5 HIGH

Unauthenticated, low-complexity network access to critical functions (PR:N/AC:L/AV:N); impact is restart/disruption only, so A:H with C:N and I:N.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (icscert).

CVSS VectorVendor: icscert

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jun 24, 2026 - 22:03 EUVD

Analysis Generated

Jun 24, 2026 - 20:51 vuln.today

DescriptionCVE.org

The Aclara Metrum Cellular Web Interface is vulnerable to unauthorized access due to the absence of authentication controls on critical system functions. This weakness exposes essential configuration settings, allowing attackers to alter operational parameters and trigger system restarts without restriction. Such unauthorized changes can disrupt normal functionality and, if performed repeatedly, may lead to a loss of communications to the device.

AnalysisAI

Missing authentication in the Aclara Metrum Cellular Web Interface (a Hubbell/Aclara cellular communications module used in utility smart-grid metering) lets remote attackers reach critical system functions without any credentials. Per the CVSS:4.0 vector (PR:N/UI:N) an unauthenticated network attacker can read and modify operational configuration and force device restarts, and repeated restarts can sever device communications - a pure availability impact (VA:H, no confidentiality or integrity loss). There is no public exploit identified at time of analysis and this CVE is not listed in CISA KEV; EPSS data was not provided.

Technical ContextAI

The affected component is the embedded web management interface of the Aclara Metrum Cellular module, an operational-technology (OT) device that provides cellular backhaul for utility metering/AMI deployments (CPE: cpe:2.3:a:hubbell:aclara_metrum_cellular_web_interface). The root cause is CWE-306 (Missing Authentication for Critical Function): security-sensitive endpoints - configuration management and the system-restart function - are exposed without any authentication gate, so the web interface trusts any caller that can reach it on the network. This is a common pattern in embedded/ICS HTTP management interfaces where critical control functions are reachable directly rather than behind a session/login layer.

RemediationAI

No vendor-released patch version is identified in the supplied data; consult CISA advisory ICSA-26-174-07 (https://www.cisa.gov/news-events/ics-advisories/icsa-26-174-07) and the Aclara support portal (https://aclara.my.site.com/AclaraConnect/s/) for the current fixed firmware/build and apply it once available. Until a fix is confirmed, the highest-value compensating control is network isolation: place the device's web interface behind the utility's private APN/VPN and a firewall, and restrict inbound access to the management HTTP(S) port to a small set of trusted operator/NMS source addresses (trade-off: legitimate remote management must be routed through that allowlisted path). Disable or block external reachability of the web interface entirely if it is not operationally required, and monitor for unexpected configuration changes or repeated device restarts as a detection signal (trade-off: monitoring detects but does not prevent the action). Because exploitation needs no credentials, do not rely on credential rotation - only reachability restrictions are effective.