PayRange API CVE-2026-18965

Per the CVE description, PayRange API management endpoints return verbose device data 'with or without an account,' meaning no authentication credential or registered PayRange account is required for exploitation - network connectivity to the PayRange API is the sole prerequisite. The official CVSS 4.0 vector assigns PR:L (low privileges required), which directly conflicts with the description's explicit 'without an account' language; security teams must verify with the vendor which is accurate before treating authentication as a meaningful control. No specific PayRange deployment configuration, enabled feature, or non-default setting is required. Exploitation is bounded to the PayRange API platform itself; no scope change to subsequent systems is indicated (SC:N/SI:N/SA:N in CVSS 4.0). The primary limiting factor is knowledge of the API endpoint structure, which is not a reliable security control given the platform's commercial availability.

The CVSS 4.0 base score of 8.7 with VC:H/VI:H/VA:H signals high impact on confidentiality, integrity, and availability of vulnerable systems - consistent with management-level API access without authorization controls. The network attack vector (AV:N), low complexity (AC:L), and absence of required interaction (UI:N) confirm remote exploitability with minimal attacker capability. A material discrepancy exists between the official CVSS 4.0 PR:L assignment and the CVE description's explicit statement that data is accessible 'with or without an account' - the effective exploitation bar may be PR:N (unauthenticated), which would elevate real-world risk further; security teams should not rely on authentication as a mitigating control until the vendor confirms otherwise. No EPSS data was present in the intelligence set, and KEV listing is not confirmed in available data. No public exploit code has been identified. Despite the absence of confirmed active exploitation, the trivial exploitation mechanics - a standard HTTP client suffices - combined with the ICS deployment context and whole-network device inventory exposure represent a meaningful operational security risk, particularly for reconnaissance enabling physical attacks or payment fraud.

An attacker with only HTTP client access to the internet sends unauthenticated requests to PayRange API management endpoints and receives structured responses containing device identifiers, physical locations, configurations, and operational status for every device on the PayRange network. With this full device inventory, the attacker maps target locations for physical skimming or tampering operations, or issues management commands to modify device behavior given the high integrity impact indicated in the CVSS data. No exploit tooling or credential material is required - the missing authorization check means standard curl or browser requests are sufficient.