CVE-2026-8979 - Authentication Bypass

Back Back to CVE browser

CRITICAL

Authentication Bypass

Published May 28, 2026

9.3

CRITICAL

CVSS 4.0

EPSS 0.73%

Description

The Mennekes Amtron series (firmware versions ≤ 5.22.3) is vulnerable to an authentication bypass. An unauthenticated remote attacker can change the password of the user account via a crafted POST request to the /operator/operator endpoint.

Affected products

Vendor Mennekes Product Amtron Default
affected
Affected
- ≥ 0, ≤ 5.22.3

Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).

Vendor	Product	Default status	Versions
Mennekes	Amtron	affected	Affected ≥ 0, ≤ 5.22.3

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-287

Improper Authentication

References (2)

Link	Providers	Tags
https://cyberdanube.com/security-research/multiple-vulnerabilities-in-mennekes-amtron-series/		exploit
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-32896		Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner CyberDanube

Published May 28, 2026

Updated May 28, 2026

Reserved May 19, 2026

Link CVE-2026-8979

CISA Vulnrichment

Updated May 28, 2026

NVD

Status Deferred

Modified Jun 17, 2026

Link CVE-2026-8979

Red Hat

No data

ENISA EUVD

Assigner CyberDanube

Published May 28, 2026

Updated May 28, 2026

Link EUVD-2026-32896

GitHub

No data