EUVD-2026-44667
GHSA-jm44-25h7-5782
Severity by source
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Adjacent network vector (AV:A) consistent with CVSS 4.0 source; no privileges or interaction needed; limited read/write impact with no availability impact or scope change.
Primary rating from Vendor (CERT-PL).
CVSS VectorVendor: CERT-PL
Lifecycle Timeline
2DescriptionCVE.org
ICU Scandinavia Boomerang is vulnerable to a missing authentication flaw in its device receiver endpoints. This allows an unauthenticated remote attacker to read full facility configurations and write unauthorized data to the sensor database. This issue has been fixed in version 2.4.18.029
AnalysisAI
Missing authorization on device receiver endpoints in ICU Scandinavia Boomerang exposes facility and quality-assurance installations to unauthenticated read and write access over adjacent networks. Any attacker with network adjacency can retrieve complete facility configurations and inject arbitrary data into the sensor database without supplying credentials, violating both confidentiality and integrity of operational sensor records. No public exploit has been identified at time of analysis, but CERT-PL's coordinated disclosure and a vendor-confirmed patch in version 2.4.18.029 indicate a concrete, addressable risk for organizations running unpatched deployments.
Technical ContextAI
ICU Scandinavia Boomerang is a quality-assurance and facility-monitoring platform (vendor page: icuscandinavia.se/boomerang-quality-assurance-lab/). The vulnerability is rooted in CWE-862 (Missing Authorization): device receiver endpoints - the interfaces through which sensors report data and receive configuration - fail to enforce any authentication gate before processing requests. The CPE string cpe:2.3:a:icu_scandinavia:boomerang:*:*:*:*:*:*:*:* covers all versions prior to the fix, confirming the flaw is present across the entire pre-patch release history. The CVSS 4.0 vector AV:A indicates exploitation requires network adjacency (same broadcast domain or VLAN), meaning the receiver endpoints are reachable only within the local network segment rather than directly from the public internet.
RemediationAI
Upgrade ICU Scandinavia Boomerang to version 2.4.18.029 or later, which is confirmed by the CVE description as the vendor-released fix. Refer to the CERT-PL advisory at https://cert.pl/posts/2026/07/CVE-2026-46458 and the vendor product page at https://icuscandinavia.se/boomerang-quality-assurance-lab/ for additional guidance. If immediate patching is not feasible, isolate Boomerang device receiver endpoints on a dedicated VLAN with firewall rules that restrict access strictly to known, authorized sensor devices and administrative hosts - this directly counters the AV:A attack vector by preventing unauthorized hosts from reaching the endpoint. Note that VLAN isolation is a compensating control only and does not eliminate the missing authorization flaw; it reduces exploitable surface while patching is arranged.
An issue was discovered in the Boomerang Parental Control application through 13.83 for Android. Rated critical severity
An issue was discovered in the Boomerang Parental Control application before 13.83 for Android. Rated medium severity (C
Information disclosure in ICU Scandinavia Boomerang (versions prior to 2.4.18.029) lets an unauthenticated attacker retr
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today