EUVD-2026-87086
GHSA-hhmm-hxw9-gfff
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach terminal over network
-
ExploitCall global API request wrapper endpoint
-
ExecutionBypass/absent authorization on wrapper
-
ImpactRetrieve sensitive device information
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection Data exposure prevention
MITRE ATT&CK
2 techniques across 2 tactics: Collection, Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates no authentication or user interaction is required: a remote unauthenticated attacker with network access to a Wellav WES100/WES270/WES280/WES290 emergency broadcast terminal running firmware before 08-08-2023 can invoke the global API request wrapper function to obtain sensitive information. Limiting factors: the target device must be network-reachable by the attacker, and these emergency-broadcast terminals are typically deployed on isolated, internal, or dedicated broadcast/utility networks rather than the public internet, which sharply narrows realistic exposure; only firmware dated before 08-08-2023 is affected. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, base 7.5) describes an easily-reachable, unauthenticated, network-accessible information-disclosure flaw - signals that on paper justify HIGH priority. However, key exploitation signals are absent: there is no EPSS score, no CISA KEV listing, and no explicitly flagged POC in the provided data, so the raw score likely overstates real-world urgency. The C:H rating is not independently verifiable - the description only says 'sensitive information' via a 'global API request wrapper function' without specifying whether credentials, full configuration, or lesser data are exposed; C:L is plausible, which would drop the score. Practically, this is a niche emergency-broadcast appliance typically deployed on isolated or internal broadcast/utility networks, so despite AV:N the realistic attack surface is narrow. Net: treat as a genuine unauthenticated disclosure bug worth patching on affected devices, but not a mass-exploitation priority - the high CVSS is tempered by low deployment footprint, isolated network positioning, and unverified impact magnitude. |
| Exploit ScenarioDerived | A remote attacker with network reach to a Wellav WES emergency broadcast terminal (firmware before 08-08-2023) sends a request that abuses the global API request wrapper function, which fails to properly enforce authorization, returning sensitive device data without authentication. No public exploit is confirmed in the provided data, though the single Chinese CSDN blog reference may contain technical write-up or proof-of-concept details. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 25, 2026
Unauthenticated remote attackers can retrieve sensitive information from Wellav WES emergency broadcast terminals - models WES100, WES270, WES280 and WES290 running firmware released before 08-08-2023 - by abusing the devices' global API request wrapper function, which returns data without adequately restricting the caller. The flaw carries a CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), meaning no credentials or user interaction are required, although exploitation still requires the terminal to be network-reachable and these units are typically deployed on isolated or dedicated broadcast/utility networks rather than the public internet. There is no public exploit code identified at time of analysis and the issue is not listed in CISA KEV, so risk is driven by exposure of the device API surface rather than confirmed active exploitation.
RemediationAI
The available intelligence does not include a Wellav security advisory or a named patch version; the only fixed state indicated is firmware dated 08-08-2023 or later, so the primary action is to upgrade WES100/WES270/WES280/WES290 units to firmware built on or after that date and to verify affected builds with Wellav support. Until an upgrade can be performed, compensating controls should target the exposure described in the assessment: keep these broadcast/utility terminals off the public internet and restrict access to the API and management interface to a small set of trusted hosts through firewall rules, ACLs, or an internal reverse proxy, accepting that legitimate remote management and headend integration traffic must be re-scoped and may break monitoring or integration workflows. Disable any unused remote API or web management features on the device, log and alert on requests to the global API request wrapper function, and treat these terminals as high-value targets given the CVSS 7.5 severity, with the trade-off of reduced operational flexibility and possible loss of vendor support for non-standard configurations; the only reference provided is the third-party write-up at https://jl-zhenlaixiaowei.blog.csdn.net/article/details/166365472?spm=1001.2014.3001.5502, so no vendor advisory URL can be cited.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected devices are Wellav WES-series emergency broadcast / EAS headend terminals in which a 'global API request wrapper' mediates inbound API calls to the device. The reported weakness is an information-disclosure condition in that wrapper: the request-handling path does not sufficiently authorize or constrain the caller before returning data, an access-control / sensitive-information-exposure class issue, which allows an unauthenticated remote party who can reach the API to pull back sensitive content (no CWE was supplied by the reporter, so the root-cause classification is inferred from the behavior described). The provided CPE string is uninformative (cpe:2.3:a:n/a:n/a), so product identification depends on the vendor/model list and the 08-08-2023 firmware cutoff rather than structured CPE data. The single reference supplied is a third-party CSDN blog post rather than a Wellav security bulletin, and the CVSS vector's AV:N/AC:L/PR:N/UI:N components confirm the exposure is reachable and unauthenticated but do not by themselves establish how broadly these terminals are internet-facing.
Know when N A gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Unauthenticated network-reachable API wrapper with no interaction gives AV:N/AC:L/PR:N/UI:N; disclosure-only so I:N/A:N, and C:H retained per description though 'sensitive information' is vague enough that C:L is plausible.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
DescriptionCVE.org
An issue in Wellav Technologies Co., Ltd Wellav WES Emergency Broadcast Terminal WES100, WES270, WES280, and WES290 before 08-08-2023 allows a remote attacker to obtain sensitive information via the global API request wrapper function
Executive ViewAI
Wellav WES emergency broadcast terminals (WES100, WES270, WES280, WES290) running firmware released before 08-08-2023 have an unauthenticated information-disclosure flaw that can expose sensitive data to anyone able to reach the device API. These systems support emergency broadcast and utility communications, so leadership should prioritize exposure reduction for any affected units on reachable networks. No public exploit identified at time of analysis, but the absence of a vendor-released patch increases operational risk.
No vendor-released patch identified at time of analysis. Restrict API access to trusted management hosts via firewall/ACL; place affected WES100/WES270/WES280/WES290 terminals on isolated management VLANs; block public internet exposure; monitor API logs for anomalous requests; engage Wellav for fixed firmware or mitigation guidance; consider temporary replacement or upgrade if exposure cannot be contained.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Exploit-DB