EUVD-2026-84259
GHSA-23h6-pfj2-vvmr
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach device WebSocket service over network
-
DeliveryConnect to /index.html endpoint
-
ExploitBypass absent authentication check
-
ExecutionIssue privileged device commands
-
ImpactCompromise terminal confidentiality and integrity
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication mechanism validation
MITRE ATT&CK
2 techniques across 2 tactics: Defense Evasion, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network reachability to the WebSocket Service exposed at /index.html on a Gigatech PDV5701 device running firmware 1.0.31_240305_112640; no authentication and no user interaction are needed (PR:N/UI:N), matching the 'missing authentication' defect. The practical limiting factor is exposure: these are niche point-of-sale/fiscal terminals typically deployed on constrained retail LANs rather than the open internet, so an attacker generally needs a foothold on the same network segment as the device. No non-default configuration is stated as required. |
| Impact | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N with VC:H/VI:H/VA:H) describes a fully remote, unauthenticated, low-complexity flaw with total impact - a worst-case profile that yields the 9.3 score. The E:P (Proof-of-Concept) exploit maturity aligns with the description's explicit statement that a public exploit exists and the referenced GitHub issue (CSDVi/cve/issues/2). However, the real-world priority is tempered by several factors: this is a single, obscure vendor device model (Gigatech PDV5701, a point-of-sale/fiscal terminal) with a very small deployment footprint; there is no CISA KEV listing and no EPSS score supplied, so there is no evidence of active or widespread exploitation. All intelligence traces to a single source (VulDB) with no independent vendor confirmation - the vendor was contacted and did not respond, so affected versions and the technical nature of the 'missing authentication' on the WebSocket service are unverified beyond VulDB's submission. The vendor-assigned subsequent-system impact (SC:H/SI:H/SA:H) appears to be over-scoping typical of automated VulDB scoring and is not substantiated by the terse description. Net: a genuinely severe technical flaw on a low-prevalence device, so priority is high only for the specific operators of this hardware, not a broad ecosystem threat. |
| Exploit ScenarioDerived | An attacker with network access to a Gigatech PDV5701 point-of-sale terminal connects to its WebSocket service exposed via /index.html and, because authentication is missing, interacts with the interface directly without any credentials. A public proof-of-concept (referenced on GitHub) reportedly demonstrates the access, letting the attacker read or manipulate device functions remotely at low complexity. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 22, 2026
Missing authentication in the WebSocket Service of the Gigatech PDV5701 point-of-sale terminal (firmware 1.0.31_240305_112640, exposed via /index.html) lets unauthenticated remote attackers reach functionality that should require credentials, yielding full confidentiality, integrity, and availability impact with a CVSS 4.0 score of 9.3. Exploitation needs only network reachability to the device's WebSocket endpoint - no credentials and no user interaction (PR:N/UI:N) - though practical exposure is limited to attackers who can route to the terminal, which is typically deployed on a constrained retail or fiscal LAN rather than the public internet. Publicly available exploit code exists; there is no confirmed evidence of active exploitation (not in CISA KEV), and the vendor was contacted prior to disclosure but did not respond.
RemediationAI
No vendor-released patch was identified at time of analysis, and the vendor did not respond to the disclosure, so remediation must currently rely on compensating controls. First, isolate Gigatech PDV5701 terminals on a dedicated VLAN or restricted retail segment and block inbound access to the device's WebSocket endpoint and /index.html web interface from any node other than an explicitly trusted management host - this eliminates the remote attack path but requires network changes and may complicate remote support. Second, if the WebSocket service is not operationally required, disable it or block the corresponding TCP port at the host firewall or upstream switch ACL, accepting that any management or integration feature depending on that channel will stop working. Third, restrict device management access to an out-of-band or jump-host-only path and remove any port forwarding, NAT, or VPN exposure of the terminal to untrusted networks. Fourth, monitor for anomalous WebSocket upgrade requests and unexpected connections to /index.html on POS subnets, since detection is the only current backstop against the publicly available exploit code. Organizations should also press Gigatech for a fixed firmware release and consider replacing or virtualizing these terminals where no fix materializes; track the CSDVi issue at https://github.com/CSDVi/cve/issues/2 and https://vuldb.com/vuln/408193/cti for updates.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The defect is rooted in CWE-287 (Improper Authentication): the WebSocket Service reachable through the device's /index.html interface fails to enforce authentication before allowing message exchange, so an attacker who can open a WebSocket connection can issue requests that the device processes as trusted. WebSocket is a persistent, full-duplex TCP-based protocol that upgrades from HTTP; because it is rarely inspected by legacy firewalls and often sits alongside the web UI, an unauthenticated handshake endpoint effectively becomes an unguarded control channel. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N with VC:H/VI:H/VA:H and subsequent-system impact SC:H/SI:H/SA:H) confirms a remotely reachable, low-complexity, no-prerequisite flaw with total impact on the affected component and potential follow-on impact to connected systems - consistent with an embedded POS/fiscal device where the WebSocket service exposes device-level operations. No CPE string was supplied, so the affected product is identified by the vendor advisory text as Gigatech PDV5701 firmware version 1.0.31_240305_112640; confirming the precise build and WebSocket daemon version on a given device is advisable before assuming exposure.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P
Remote, low-complexity, unauthenticated access to a service with missing authentication (AV:N/AC:L/PR:N/UI:N) grants full device control (C/I/A:H); scope kept Unchanged as no cross-system impact is substantiated.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
DescriptionCVE.org
A vulnerability was detected in Gigatech PDV5701 1.0.31_240305_112640. This issue affects some unknown processing of the file /index.html of the component WebSocket Service. The manipulation results in missing authentication. The attack can be launched remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Technical POC Analysis
CWE-287 Improper Authentication.
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Latest POC
1 PoC candidate from github (unverified)
Sign in to open the public PoC links collected for this CVE.
Executive ViewAI
Gigatech PDV5701 point-of-sale terminals running firmware 1.0.31_240305_112640 can be fully compromised over the network by an unauthenticated attacker, exposing payment and fiscal transaction data, terminal configuration, and service availability in every store where these devices are deployed. Publicly available exploit code exists, the vendor was contacted but did not respond, and no vendor-released patch has been identified, so the organization cannot rely on patching and must instead contain exposure through network controls. This is a retail-operations, payment-security, and PCI-scope issue rather than a routine IT patch item, and it warrants an inventory-and-isolate decision within days, not weeks.
No vendor-released patch identified at time of analysis, so interim mitigations are network- and configuration-based: isolate POS terminals onto a dedicated payment/fiscal VLAN with deny-by-default rules blocking access to the WebSocket service and /index.html management interface except from a defined management host; prevent any routing from corporate, guest, wireless, or internet networks to the terminal subnet; disable or block the browser-accessible management interface where not operationally required; monitor and alert on anomalous connections to the terminal's WebSocket endpoint; track vendor advisories for firmware updates and press the vendor through commercial channels for a fix; consider hardware replacement or a virtual patching/IPS control in front of POS segments where the device cannot be sufficiently isolated. Note that public exploit code exists and no confirmed active exploitation has been observed (not listed in CISA KEV), so containment priority should track the organization's actual network exposure.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB