EUVD-2026-94868
GHSA-6vq9-p4m4-cq5x
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach WOLVOX Control Panel over network
-
ExploitInvoke data-pull from system resources
-
ExecutionSensitive information returned in response
-
ImpactHarvest disclosed system data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection Outbound data filtering
|
| Exploitation Conditions | Requires network reachability to an exposed AKINSOFT WOLVOX Control Panel instance in an affected version (26.02.25 up to but not including 26.02.26). Per the provided CVSS vector (AV:N/AC:L/PR:N/UI:N), no authentication or user interaction is required against a reachable instance, and exploitation centers on the 'Pull Data from System Resources' function causing sensitive data to be placed into sent responses. Limiting factors: the Control Panel must be network-accessible to the attacker (instances behind segmentation/VPN or not internet-exposed are not reachable), and the specific feature/endpoint enabling the data pull must be present and operative; the exact configuration preconditions are not detailed in the available data. |
| Impact | The input assigns a CVSS 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating network-exploitable, unauthenticated attack with no user interaction. However, this score is internally inconsistent with the vulnerability class: CWE-201 (Insertion of Sensitive Information Into Sent Data) is a confidentiality-only information-disclosure weakness, yet the vector claims High Integrity and Availability impact - these I:H/A:H values appear unjustified for a data-exposure flaw and likely inflate the score. A more defensible assessment is C:H/I:N/A:N (see assessed vectors). No EPSS score is provided, the vulnerability is NOT in CISA KEV, and no public POC is referenced, so there is no evidence of active or imminent exploitation. Exploitation status: no public exploit identified at time of analysis. The vulnerability was responsibly reported by TR-CERT (Turkish national CERT) and a vendor patch is available, which lowers operational urgency. Net: despite the headline 9.8, real-world risk is tempered by low product prevalence (a regional Turkish business-software suite), absence of exploitation signals, and an inflated CVSS vector - treat as a genuine confidentiality issue to patch, but not a mass-exploitation emergency. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker interacts with the AKINSOFT WOLVOX Control Panel over the network and triggers the 'Pull Data from System Resources' behavior, causing the application to include sensitive system-resource information in data it sends back. No public exploit code is known, but the CVSS vector (AV:N/AC:L/PR:N/UI:N) implies the disclosure can be obtained with a low-complexity network request against an affected instance. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Oct 08, 2026
Unauthenticated information disclosure in the AKINSOFT WOLVOX Control Panel (versions 26.02.25 up to but not including 26.02.26) lets a remote attacker reach the panel over the network and pull sensitive data from system resources into responses sent back to the client. Because the assessed attack vector is AV:N/AC:L/PR:N/UI:N, no credentials or user interaction are needed against an internet- or network-reachable instance, and successful exploitation yields high confidentiality impact (C:H), exposing host/system-level information to an unauthorized party. Note that the supplied base vector (9.8) also asserts high integrity and availability impact, whereas the independent assessment scopes the issue to confidentiality only (I:N/A:N); either way the practical effect is data exposure rather than code execution or service disruption. No public exploit code or confirmed active exploitation has been identified at time of analysis, and the vendor has released a fix.
Earlier versions of this analysis (1)
Remote unauthenticated information disclosure in AKINSOFT WOLVOX Control Panel versions from 26.02.25 before 26.02.26 allows a network-reachable attacker to read sensitive data that the application pulls from system resources and inserts into outbound responses. The authoritative independent assessment maps this to CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, so the confirmed impact is high confidentiality loss with no integrity or availability effect; no public exploit code or active exploitation was identified at time of analysis.
RemediationAI
Vendor-released patch is available: upgrade AKINSOFT WOLVOX Control Panel to 26.02.26 or later, the first version outside the affected range (26.02.25 <26.02.26), per the TR-CERT bulletin TR-26-1273 at https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1273 and the NVD record at https://nvd.nist.gov/vuln/detail/CVE-2026-92555. If immediate upgrade is not possible, the highest-value compensating control is to remove network exposure of the Control Panel entirely - bind it to localhost or an internal management segment, and require VPN or an authenticating reverse proxy for any administrative access; the trade-off is loss of remote/direct panel access for legitimate administrators. Where the 'Pull Data from System Resources' capability is not operationally required, disable or block that function at the web server/proxy layer (deny the specific route) - this closes the exposure path but may break monitoring or support workflows that depend on it. Restrict inbound access by source IP allowlist to trusted admin ranges and rate-limit the panel's endpoints; because the attack requires no authentication, IP allowlisting and segmentation are the only barriers that actually block it. Finally, treat any instance that was reachable and unpatched as potentially compromised: review control-panel and web server logs for anomalous data-pull requests, and rotate credentials, API keys, and any system-resource data that the panel may have returned to an untrusted client.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause class is CWE-201, Insertion of Sensitive Information Into Sent Data: the application constructs outbound messages (in this case the response to the Control Panel's 'Pull Data from System Resources' function) that include sensitive values harvested from the underlying system, rather than filtering, minimizing, or properly gating that content. This is a data-flow and output-sanitization defect rather than a memory-safety or injection flaw: the sensitive information is legitimately available to the component, but it is returned to a caller that should not receive it, and the endpoint lacks an effective authorization or exposure boundary. The affected technology is the AKINSOFT WOLVOX Control Panel, the administrative/management web interface component of the AKINSOFT WOLVOX business (ERP) software family from AKIN Software. The supplied CPE string (cpe:2.3:a:akin_software_computer_import-export_industry_and_trade_co._ltd.:akinsoft_wolvox_control_panel:*:*:*:*:*:*:*:*) uses a version wildcard, so it flags the product generically; the EUVD data narrows the impacted range to 26.02.25 through versions before 26.02.26, which is the actionable boundary. The evaluator's reduced vector confirms the exploitation path is reachable over the network with low complexity and no privileges, with impact confined to disclosure of system-sourced data.
Know when Akinsoft Wolvox Control Panel gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE-201 information disclosure yields C:H but no integrity or availability impact, so I:N/A:N; network, unauthenticated, low-complexity per description retained as AV:N/AC:L/PR:N.
Primary rating from Vendor (TR-CERT).
CVSS VectorVendor: TR-CERT
Lifecycle Timeline
3DescriptionCVE.org
Insertion of sensitive information into sent data vulnerability in AKIN Software Computer Import-Export Industry and Trade Co. Ltd. AKINSOFT WOLVOX Control Panel allows Pull Data from System Resources.
This issue affects AKINSOFT WOLVOX Control Panel: from 26.02.25 before 26.02.26.
Executive ViewAI
AKINSOFT WOLVOX Control Panel deployments on version 26.02.25 and any builds below 26.02.26 face a critical unauthenticated information-disclosure risk that can expose host and system-level data to anyone who can reach the panel over the network. Because no credentials or user interaction are required, internet- or network-exposed instances create immediate data-exposure and regulatory concerns for the teams relying on this panel. Leadership should prioritize inventory and patching to 26.02.26, as successful exploitation affects confidentiality and could reveal sensitive operational information.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB