Genian SSL PNS EUVD-2026-90485

Exploitation requires the attacker to already possess valid first-factor credentials (PR:L) for Genian SSL PNS and network reachability to its login endpoint; the attack then succeeds by manipulating a specific login-request parameter to skip the MFA step. The AT:P attack-requirement and the missing-authorization root cause (CWE-862) mean the bypass depends on reaching a particular state in the login flow rather than being a fully unauthenticated, any-request exploit. Limiting factors: the attacker must hold a working first factor (stolen/phished password or a valid low-privilege account), MFA must be the deployed/enforced control being bypassed, and the affected Frodo-Core version must be in use; no user interaction is required (UI:N). Exact vulnerable versions are not specified in the available data and should be confirmed against the vendor advisory.

This is a credible, above-average-priority issue for organizations that run Genian SSL PNS, though the real-world population of such deployments is limited. The vendor-supplied CVSS 4.0 vector (7.3, AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H) tells a coherent story: a network-reachable, low-privileged actor who already holds first-factor credentials manipulates a login request parameter to skip the MFA step (CWE-862, missing authorization). The AT:P (attack-requirement present) metric and PR:L indicate this is not a wholly unauthenticated drive-by - the attacker needs a valid first factor and some specific login-flow condition - which is why complexity should be treated as elevated (I map AT:P to AC:H in 3.1 terms). The standout signal is the subsequent-system impact (SC:H/SI:H/SA:H): defeating MFA on an SSL/VPN access product hands an attacker the full trust that MFA was protecting, i.e. access into the protected network, which is precisely the high-value outcome attackers pursue. No EPSS score, no CISA KEV listing, and no public exploit were provided, so there is no public exploit identified at time of analysis and no evidence of active exploitation; exploitation status is therefore driven by severity and attacker-value reasoning, not by observed activity. Net: higher-than-CVSS-baseline concern for the narrow set of affected organizations because MFA bypass on a remote-access product is exactly the kind of flaw targeted actors weaponize, but low urgency for the broader population given the niche footprint and absence of exploitation signals.

An attacker who has obtained or been issued low-privilege first-factor credentials (e.g. a leaked or phished password) connects to the Genian SSL PNS login endpoint and submits a crafted login request in which a specific parameter is manipulated to bypass the multi-factor authentication challenge, completing login without the second factor. With MFA defeated, the attacker gains the authenticated SSL/VPN access the second factor was meant to gate, pivoting into the protected internal network. No public proof-of-concept exploit was provided in the available data.