CVE-2026-2405
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
CWE-400 Uncontrolled Resource Consumption vulnerability exists that could cause excessive troubleshooting zip file creation and denial of service when a Web Admin user floods the system with POST /helpabout requests.
Risk Assessment
An attacker could exhaust system resources, causing service unavailability for legitimate users.
Recommendation
Restrict access to the Web Admin interface or update the software to a patched version. Monitor and rate-limit requests to /helpabout.
Other vulnerabilities in Web Admin
See all- CVE-2026-2403Medium
A CWE-1284 (Improper Validation of Specified Quantity in Input) vulnerability allows a Web Admin user to alter the POST /logsettings request payload and cause Event and Data Log truncation, impacting log integrity.
- CVE-2026-2401Medium
CWE-532 insertion of sensitive information into a log file can expose confidential data when a Web Admin user executes a malicious file provided by an attacker.
- CVE-2025-11565High
CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that could cause elevated system access when a Web Admin user on the local network tampers with the POST /REST/UpdateJRE request payload.
Original NVD description (English source)
CWE-400 Uncontrolled Resource Consumption vulnerability exists that could cause excessive troubleshooting zip file creation and denial of service when a Web Admin user floods the system with POST /helpabout requests.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS