UGREEN CM933 CVE-2026-8185

The attacker must be present on the local network and have network access to the UGREEN CM933 administrative interface. The vulnerability is not remotely exploitable over the internet; only devices reachable via local network segments (LAN, WiFi, or directly connected) can trigger it. Default configuration appears to be vulnerable-no special device settings or administrative enablement is documented as required. The 'unknown function' condition means exploitation scope depends on which administrative functions are exposed without authentication; if critical operations are guarded elsewhere, impact may be contained.

The CVSS score of 6.3 (medium) reflects the attack vector (AV:A, local network only), low complexity (AC:L), and no privilege requirement (PR:N), but the scope is unchanged and impact is limited (C:L/I:L/A:L). The restriction to local network significantly reduces real-world risk compared to a network-based attack. No KEV listing or public exploit code is documented, indicating this is not actively exploited at scale. The unspecified nature of the 'unknown function' complicates risk assessment-if it controls critical operations or sensitive data, real impact may exceed the CVSS rating. The vendor's commitment to a late-April patch suggests internal triage classified this as non-critical but reproducible. Risk is highest for organizations with CM933 devices exposed to untrusted internal networks or multi-tenant environments.

An attacker on the same local network segment as a UGREEN CM933 device (e.g., via compromised IoT device, rogue WiFi client, or internal network access) sends crafted requests to the administrative interface targeting the unspecified vulnerable function. Without authentication validation, the interface processes the request and allows the attacker to read, modify, or disrupt device functionality, potentially affecting connected storage or services.