Lines CVE-2026-33268

The CVSS 3.1 vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L) indicates network-accessible exploitation with low complexity and no privilege requirement—reflecting a straightforward attack path. The integrity and availability impacts are both present; integrity impact is limited (I:L) due to potential firmware upload, and availability impact is limited (A:L) due to storage exhaustion. While the CVSS score of 6.5 is moderate, the real-world risk is elevated by the absence of authentication controls on a firmware-facing endpoint, which is typically a critical security boundary. The combination of unauthenticated remote access, automatable exploitation (no user interaction required), and direct impact on device functionality makes this a legitimate priority despite the moderate CVSS rating. The existence of a CISA advisory (va-26-084-01.json) suggests government interest and potential active reconnaissance in the wild.

An attacker on the same network (or accessible to the device's IP via port forwarding or direct internet exposure) sends HTTP POST requests containing large binary payloads to the device's firmware upload endpoint without providing any authentication credentials. Because the endpoint lacks authentication validation, each request is accepted and stored on the device's limited internal flash storage. After several such requests, the device's storage becomes exhausted, causing the device to become unresponsive, lose configuration data, or fail to boot normally—effectively bricking the device until manual intervention or factory reset is performed. No exploit code or proof-of-concept is required; standard HTTP clients suffice.