EUVD-2026-52374
GHSA-59gp-6cxx-c7v9
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible endpoint requires no authentication (PR:N); impact is limited to file listing disclosure (C:L) with no integrity or availability effect and no scope change.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability was detected in NewType WebEIP up to 3.0. This affects an unknown part of the file /EIP_Com_FileList.aspx. The manipulation results in improper authentication. It is possible to launch the attack remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
Unauthenticated remote access to the /EIP_Com_FileList.aspx endpoint in NewType WebEIP up to version 3.0 exposes file listing functionality to any network-reachable attacker due to improper authentication enforcement (CWE-287). A public proof-of-concept exploit hosted on Google Drive is confirmed available, lowering the exploitation bar significantly. No vendor patch exists as the vendor did not respond to disclosure; organizations must rely entirely on compensating controls.
Technical ContextAI
NewType WebEIP is an ASP.NET-based Enterprise Information Portal product identified by CPE cpe:2.3:a:newtype:webeip:*:*:*:*:*:*:*:*, targeting all versions up to 3.0. The vulnerable component is /EIP_Com_FileList.aspx, an ASP.NET Web Forms page responsible for presenting file and directory listings. CWE-287 (Improper Authentication) indicates the server-side code on this endpoint does not validate session tokens, cookies, or credentials before processing and responding to requests, effectively exposing the file enumeration logic to unauthenticated callers. This class of flaw typically arises when individual ASP.NET pages fail to inherit or enforce centralized authentication middleware, leaving discrete endpoints unprotected even when the broader portal requires login.
RemediationAI
No vendor-released patch is available at time of analysis due to vendor non-response to the disclosure. The primary recommended control is to block unauthenticated external access to /EIP_Com_FileList.aspx via a web application firewall rule or reverse proxy ACL - this surgically addresses the exposure without requiring application changes, though it must be maintained if the application is updated. If the file listing feature is not operationally required, removing or disabling the /EIP_Com_FileList.aspx endpoint from the web server eliminates the attack surface entirely. Placing the WebEIP portal behind a VPN or network-layer authentication gateway prevents unauthenticated internet-facing access and is the most effective compensating control, with the trade-off of added access complexity for legitimate users. Monitor VulDB at https://vuldb.com/vuln/385531 and https://vuldb.com/cve/CVE-2026-18610 for any future vendor response or patch release.
WebEIP v3.0 from NewType does not properly validate user input, allowing remote attackers with regular privilege to inje
NewType WebEIP v3.0 does not properly validate user input, allowing a remote attacker with regular privileges to insert
Same weakness CWE-287 – Improper Authentication
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today