CVE-2026-8185
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk24th percentile - higher than 24% of all known CVEs
Summary
A vulnerability in UGREEN CM933 version 1.1.59.4319 involves missing authentication in the administrative interface. The attack requires local network access. The vendor confirmed the issue and plans a fix in late April.
Risk Assessment
The risk involves unauthorized access to the administrative interface by an attacker on the local network, potentially leading to full device compromise.
Recommendation
Update UGREEN CM933 firmware to the latest version after the fix is released (planned for late April). Until then, restrict local network access.
Original NVD description (English source)
A security vulnerability has been detected in UGREEN CM933 1.1.59.4319. The impacted element is an unknown function of the component Administrative Interface. Such manipulation leads to missing authentication. The attack requires being on the local network. You should upgrade the affected component. The vendor replied: "We have successfully confirmed and reproduced the issue. We take this matter very seriously and have incorporated the fix into our development schedule. The issue is scheduled to be resolved in the release version coming in late April."