EUVD-2026-67312
GHSA-fhjr-g4q7-hq4j
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Description explicitly states access requires no account (PR:N); management endpoint scope implies integrity and availability impact alongside confirmed confidentiality exposure.
Primary rating from Vendor (icscert).
CVSS VectorVendor: icscert
Lifecycle Timeline
6DescriptionCVE.org
PayRange API is missing proper authorization on management endpoints, which allows verbose details of every device on the PayRange network to be publicly accessible, with or without an account.
AnalysisAI
Unauthenticated access to PayRange API management endpoints exposes verbose device details for every device on the PayRange network, exploitable with or without a registered account. Classified under CWE-862 (Missing Authorization) and reported by CISA ICS-CERT as advisory ICSA-26-237-04, the flaw affects all tracked versions of the PayRange API with a CVSS 4.0 score of 8.7 reflecting high impact across confidentiality, integrity, and availability. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Per the CVE description, PayRange API management endpoints return verbose device data 'with or without an account,' meaning no authentication credential or registered PayRange account is required for exploitation - network connectivity to the PayRange API is the sole prerequisite. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 base score of 8.7 with VC:H/VI:H/VA:H signals high impact on confidentiality, integrity, and availability of vulnerable systems - consistent with management-level API access without authorization controls. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The primary remediation is implementation of proper server-side authorization enforcement on all PayRange API management endpoints, ensuring that every request is validated against the caller's privilege level before returning device data or accepting management commands; consult CISA advisory ICSA-26-237-04 at https://www.cisa.gov/news-events/ics-advisories/icsa-26-237-04 for vendor-specific patch guidance, as no exact patched API version has been independently confirmed in available data. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all PayRange API deployments and confirm whether management endpoints are internet-accessible; implement immediate network-layer access controls (firewall rules, IP whitelisting, or VPN-only access) to restrict API endpoint connectivity to authorized administrative sources only. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today