EUVD-2026-44578
GHSA-467v-w526-45hg
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Network-accessible REST endpoint requires only low-privilege authentication; impact is purely availability loss with no confidentiality or integrity component, scoped to the single system.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
Incorrect access control in the /api/License/deactivateOffline endpoint of CAXPerts UniversalPlantViewer WebServices Server v2.7.6 allows authenticated attackers with low-level privileges to cause a Denial of Service (DoS) via removing the license from the webserver.
AnalysisAI
Incorrect access control in CAXPerts UniversalPlantViewer WebServices Server v2.7.6 allows any authenticated low-privilege user to invoke the /api/License/deactivateOffline endpoint and strip the server's license, rendering the service inoperable. The flaw (CWE-284) grants low-privileged accounts an action that should be restricted to administrative roles, providing a trivial denial-of-service primitive against industrial plant visualization infrastructure. No public exploit identified at time of analysis, though a researcher disclosure post on Medium appears to document the discovery.
Technical ContextAI
CAXPerts UniversalPlantViewer is a web-based 3D plant visualization platform used in industrial and engineering environments; its WebServices Server component exposes a REST API for management functions including license control. The /api/License/deactivateOffline endpoint is designed for offline license removal but lacks authorization enforcement at the privilege level - CWE-284 (Improper Access Control) manifests because the server authenticates the caller but does not verify that the caller holds sufficient privileges to alter licensing state. Any session token belonging to a standard (low-privilege) user is accepted by the endpoint as sufficient. The affected version is v2.7.6 per the CVE description; no CPE strings were provided in the source data, and EUVD lists affected version metadata as 'n/a', limiting automated product-matching confidence.
RemediationAI
No vendor-released patch or fixed version has been identified at time of analysis - no advisory URL with a specific remediation version was included in the provided references, and the vendor sites (https://caxperts.com, https://universalplantviewer.com) should be monitored directly for patch availability. As immediate compensating controls, administrators should restrict network access to the WebServices Server API to trusted IP ranges or VPN segments, eliminating internet-exposed access and reducing the attack surface significantly; the trade-off is that legitimate remote users will require VPN connectivity. Additionally, enforce role-based access controls at the network or reverse-proxy layer to block low-privilege accounts from reaching the /api/License/ endpoint family, allowing only designated admin accounts to reach that URI path - most reverse proxies (nginx, Apache) can enforce this via location-block ACLs. Audit active user accounts to minimize the number of valid low-privilege credentials that could be leveraged for this attack.
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today