CVE-2026-70381
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk17th percentile - higher than 17% of all known CVEs
Summary
An access-control vulnerability has been identified in the web server configuration. Some resources intended for on-device use only could be accessed remotely by an unauthenticated attacker with network access to the web interface. The accessible resources do not expose credentials or provide administrative functionality, but may include non-public device content, such as screen-saver content or assets used by the web interface.
Risk Assessment
An unauthenticated attacker with network access could access non-public device content, potentially disclosing internal information. The risk applies to devices with an exposed web interface.
Recommendation
Update the device software to a version containing the access-control fix. Restrict network access to the web interface to trusted networks only.
Other vulnerabilities in web server
See all- CVE-2025-41737High
Due to webserver misconfiguration, an unauthenticated remote attacker is able to read the source of PHP modules.
- CVE-2025-9177High
A denial-of-service security issue exists in the affected product and version, stemming from a high number of requests sent to the web server. This can cause a web server crash but does not impact I/O control or communication; a power cycle is required to recover the webpage.
Original NVD description (English source)
An access-control vulnerability has been identified in the web server configuration. Some resources intended for on-device use only could be accessed remotely by an unauthenticated attacker with network access to the web interface. The accessible resources do not expose credentials or provide administrative functionality, but may include non-public device content, such as screen-saver content or assets used by the web interface.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS