EUVD-2026-41371
GHSA-6qqj-v86p-pcpj
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Missing authentication on a network-reachable critical function gives unauthenticated, low-complexity, no-interaction access (AV:N/AC:L/PR:N/UI:N) with full appliance compromise, so C/I/A all High.
Primary rating from Vendor (TR-CERT).
CVSS VectorVendor: TR-CERT
Lifecycle Timeline
1DescriptionCVE.org
Missing authentication for critical function vulnerability in TR7 Cyber Defense Inc. WAF-ASP allows Authentication Abuse.
This issue affects WAF-ASP: from v1.0.324.900 before v1.4.0.117.
AnalysisAI
Authentication abuse in TR7 Cyber Defense WAF-ASP (versions v1.0.324.900 through v1.4.0.116) lets remote unauthenticated attackers invoke a security-critical function that fails to enforce any authentication check, yielding full compromise of confidentiality, integrity, and availability per the CVSS 9.8 rating. Because WAF-ASP is a web application firewall, abusing this exposed function can subvert the very protection layer meant to shield downstream applications. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV; disclosure comes from Turkey's national CERT (TR-CERT).
Technical ContextAI
WAF-ASP is a web application firewall (WAF) product from the Turkish vendor TR7 Cyber Defense Inc. The root cause is CWE-306 (Missing Authentication for Critical Function): a function that performs a security-sensitive operation is reachable over the network without verifying the caller's identity or privileges. The single CPE entry, cpe:2.3:a:tr7_cyber_defense_inc.:waf-asp, confirms this is application software rather than firmware or an OS component. In WAF products, such critical functions typically include rule/policy management, configuration, or administrative APIs; exposing any of these without authentication allows an attacker to manipulate filtering behavior or the appliance itself, which is why the CVSS vector marks all three impact metrics High.
RemediationAI
Upgrade WAF-ASP to v1.4.0.117 or later, which is the first release outside the affected range and per the disclosure the fixed version (Vendor-released patch: v1.4.0.117). Consult the TR-CERT advisory at https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0487 for vendor guidance. Until the upgrade is applied, restrict network reachability of the WAF-ASP management and API interfaces to trusted administrative networks or a VPN, and place an access-control list or upstream reverse proxy in front of the affected critical function endpoint so unauthenticated Internet clients cannot reach it - noting the trade-off that tightening access to a WAF's own control plane may disrupt legitimate remote administration or automated policy updates. Because the exposed function requires no authentication, monitor logs for unexpected calls to administrative or policy endpoints as a detection compensating control.
Stored XSS in TR7 Cyber Defense Inc.'s WAF-ASP web application firewall permits authenticated low-privilege attackers to
DOM-Based cross-site scripting in TR7 Cyber Defense Inc.'s WAF-ASP product allows an authenticated low-privilege attacke
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today