AxxonNet EUVD-2026-115711

Exploitation requires the attacker to already possess a valid AxxonNet 'shared report token' that was issued for read-only report access, and network reachability to the Health Monitoring service's monitoring API on an instance running a version before 3.28.0 on Linux. The flaw is that this read-only-scoped token is incorrectly accepted for write operations (create/modify/delete alerts). Limiting factors: the attacker cannot act fully unauthenticated - a valid shared token is a hard prerequisite (PR:L); impact is confined to monitoring alert data (no confidentiality loss and no system-level code execution), so the realistic risk is suppression or forgery of health alerts rather than full compromise.

This is a medium-severity authorization flaw, not a high-priority emergency. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L) scores 5.3 and is internally consistent with the description: network-reachable, low attack complexity, requires a low-privilege credential (the shared read-only report token, hence PR:L not PR:N), no user interaction, no confidentiality loss, and only limited integrity/availability impact (VI:L/VA:L) because the attacker can tamper with monitoring alerts rather than the underlying system. The decision signals point to moderate urgency: the vuln.today priority label is 'this_month', not act_now or emergency. There is no EPSS score, no CISA KEV listing, and no PoC/exploit reference in the input, so exploitation status is 'no public exploit identified at time of analysis'. SSVC-style reasoning supports de-escalation: exploitation is not observed, technical impact is partial (alert integrity only, no code execution or data disclosure), and the precondition of already holding a valid shared token limits the attacker population to those who have been granted read-only report access. The main real-world concern is a confidentiality-of-alerting failure: an attacker who legitimately or illicitly obtained a read-only token can blind or spoof the Health Monitoring alert channel, which has security-operations consequences disproportionate to the raw score. No conflicting signals were found between the vector and the description.

An attacker who has obtained a shared report token for AxxonNet - a token intended only for read-only viewing of monitoring reports - sends crafted requests to the Health Monitoring monitoring API. Because the service checks authentication but not that the token is read-only, the attacker creates, alters, or deletes monitoring alerts, potentially suppressing alerts for real incidents or injecting false ones. No public exploit code or PoC reference is provided in the available sources.