Akubela HyPanel PS51 EUVD-2026-109982

Specific prerequisite from the description: the attacker must send a request to the /login endpoint with the argument engrmode set to the value admin, which triggers improper authentication. The attack is remote over the network and requires no prior privileges (PR:N). Limiting factors: the vendor vector lists UI:P (passive user interaction), but the description provides no user-interaction step and does not explain the trigger, so this condition is unverified; impact is rated low across C/I/A, suggesting the bypass may yield limited rather than full administrative control. Exploitation is confined to this specific firmware build (51.130.40.26) of the Akubela HyPanel PS51, and no vendor patch exists because the vendor did not respond.

Signals are moderate and partly incomplete. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P) scores 5.3 (medium): network-reachable, low complexity, no privileges required, but with passive user interaction (UI:P) and only low impact to confidentiality, integrity and availability (VC:L/VI:L/VA:L, no scope change). The exploitation sub-metric is E:X (not defined), and no EPSS score and no CISA KEV status were supplied, so probability of real-world exploitation cannot be quantified from the input. The vuln.today decision label is 'this_month' - a routine-patch priority, not act_now or emergency. A public PoC reference exists on GitHub (wisklr) but it is not verified as working exploit code, so this should not be treated as confirmed active exploitation. CONFLICT TO VERIFY: the vector asserts UI:P, yet the description ('manipulation of the argument engrmode with the input admin') describes a direct parameter-based authentication bypass with no stated user-interaction step - the trigger mechanism and the need for user interaction are not explained in the available sources, so the UI:P weighting is uncertain. Net: a medium-severity improper-authentication issue on a niche device, worth patching on a normal cycle rather than as an emergency, with the caveat that the vendor did not respond and no fix is available.

A remote attacker reachable over the network sends a request to the device's /login endpoint supplying the parameter engrmode with the value admin, which causes the authentication logic to improperly grant access. A public PoC reference exists (GitHub, wisklr) but is not verified as working exploit code, and the precise trigger (including why the vendor vector lists UI:P) is not described in the available sources.