EUVD-2026-45138
GHSA-29w9-32wg-pfh2
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local access and administrator privileges required to interact with removable media validation; no confidentiality or availability impact from unauthorized file write.
Primary rating from Vendor (TXOne).
CVSS VectorVendor: TXOne
Lifecycle Timeline
3DescriptionCVE.org
Improper Access Control vulnerability in the Removable Media Validation function of TXOne Networks products allows a local attacker with administrator privileges to bypass the file lockdown mechanism, resulting in unauthorized file transfer to the victim device. The attacker needs to deploy unauthorized file on the removable media in advance. This issue affects SafePortAgent: before 3.2.5024; StellarProtect: from 3.2.4011 before 5.0.1083.
AnalysisAI
Improper Access Control in TXOne Networks' Removable Media Validation function allows a local administrator to bypass the file lockdown mechanism enforced by SafePortAgent (before 3.2.5024) and StellarProtect (3.2.4011 through before 5.0.1083), enabling unauthorized file transfer to a protected device via specially prepared removable media. The attack requires pre-positioning unauthorized files on the removable media before insertion, making this a deliberate, multi-step insider or supply-chain adjacent threat rather than opportunistic exploitation. No public exploit code or active exploitation has been identified at time of analysis; the vendor self-reported this issue through their PSIRT.
Technical ContextAI
TXOne Networks SafePortAgent and StellarProtect are OT/ICS endpoint security products designed for industrial environments, with a core capability of enforcing removable media policies - specifically controlling which files may be transferred to or from USB drives and similar devices. The Removable Media Validation function acts as a file lockdown gatekeeper. The CPE strings (cpe:2.3:a:txone_networks:safeportagent:*:*:*:*:*:*:*:* and cpe:2.3:a:txone_networks:stellarprotect:*:*:*:*:*:*:*:*) confirm both application-layer products are affected. Although CWE is listed as N/A by the reporter, the behavior is consistent with CWE-284 (Improper Access Control) or CWE-863 (Incorrect Authorization) - the enforcement logic for the lockdown policy can be circumvented by an actor already holding local administrator privileges, suggesting the validation check does not adequately account for privilege-level bypass scenarios.
RemediationAI
Upgrade SafePortAgent to version 3.2.5024 or later and StellarProtect to version 5.0.1083 or later, per the TXOne Networks PSIRT advisory at https://www.txone.com/psirt/cve-2026-41993/. These are the minimum fixed versions derivable from the affected version ranges in the CVE description; confirm exact patched build numbers against the vendor advisory before deployment. If patching is not immediately possible, compensating controls should focus on restricting the administrator account pool to the minimum necessary personnel, enabling multi-person authorization workflows for removable media operations where the platform supports it, and implementing out-of-band monitoring (e.g., SIEM alerts on removable media insertion events on protected endpoints) to detect anomalous transfers. Physical controls - such as port blockers on endpoints that do not legitimately require removable media - reduce the attack surface further, though this may not be operationally feasible in all OT environments. Note that these compensating controls do not eliminate the vulnerability; they raise the bar for exploitation.
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today