CVE-2026-11841
An attacker can read and write sensitive files on the device through the AppEngine Fileaccess over HTTP because the system does not enforce authentication. The exposed directories include device parameter files and the custom application directory, allowing attackers to change settings, passwords, or run arbitrary Lua code. This flaw can lead to serious compromise of the device.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
Devices that use the AppEngine Fileaccess over HTTP feature; no specific product versions are listed in the CPE data.
Real-world impact
An attacker could read and modify device configuration files, change passwords, and execute arbitrary Lua scripts, potentially taking full control of the device.
Why this severity
The CVSS score of 9.4 reflects the lack of authentication (AV:N, PR:N), low attack complexity, and the high impact on confidentiality and integrity, with a moderate impact on availability.
What to do about it
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources