Next Terminal
Monthly
Broken object-level authorization on the portal ping and wake-on-LAN endpoints in Next Terminal exposes all registered asset metadata and WoL controls to any authenticated portal user, regardless of their assigned asset permissions. The wildcard CPE (all versions) indicates no patched release exists, and the flaw is rooted in CWE-862 (Missing Authorization) - a structural gap in the access-control layer rather than a logic edge case. An attacker holding any valid portal credential can silently enumerate asset display names, IP addresses, reachability status, and connection timing, then issue WoL packets to bring unauthorized offline assets online. No public exploit code or CISA KEV listing has been identified at time of analysis.
Broken object-level authorization on the portal ping and wake-on-LAN endpoints in Next Terminal exposes all registered asset metadata and WoL controls to any authenticated portal user, regardless of their assigned asset permissions. The wildcard CPE (all versions) indicates no patched release exists, and the flaw is rooted in CWE-862 (Missing Authorization) - a structural gap in the access-control layer rather than a logic edge case. An attacker holding any valid portal credential can silently enumerate asset display names, IP addresses, reachability status, and connection timing, then issue WoL packets to bring unauthorized offline assets online. No public exploit code or CISA KEV listing has been identified at time of analysis.