{"id":"CVE-2026-116371","kind":"vulnerability","aliases":["CVE-2026-116371"],"related":[],"title":"Akuvox HyPanel PS51: login flaw allows improper authentication remotely","description":"A weakness has been identified in Akuvox Akubela HyPanel PS51 51.130.40.26. The impacted element is an unknown function of the file /login. Executing a manipulation of the argument engrmode with the input admin can lead to improper authentication. The attack may be launched remotely. The vendor was contacted early about this disclosure but did not respond in any way.","summary":"Akuvox Akubela HyPanel PS51 version 51.130.40.26 has a weakness in its /login handler where manipulating the engrmode argument with the value admin leads to improper authentication. The sources say an attacker can trigger it remotely, and the vendor did not respond to early disclosure.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["akuvox","hypanel","infrastructure","iot","ps51","self-hosted"],"not_affected_if":["no-network-exposure","other-versions"],"how_to_check":"- Check whether the device or panel runs `51.130.40.26` of HyPanel PS51 (the version is shown in the admin interface; exact location unknown)\n- Check whether `/login` on the HyPanel web interface accepts an `engrmode` parameter set to `admin` (unknown from sources)","fix":"- No vendor fix is documented in the sources; the vendor did not respond to disclosure\n- Restrict network access to the HyPanel management interface until a fixed version or vendor guidance is available","status":"open","published_at":"2026-10-26T17:17:26+00:00","first_seen_at":"2026-10-26T17:31:22+00:00","triaged_at":"2026-10-26T17:33:03+00:00","updated_at":"2026-10-26T17:33:03+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-26T17:33:03Z","model":"claude-haiku-5-5","output":{"fix":"- No vendor fix is documented in the sources; the vendor did not respond to disclosure\n- Restrict network access to the HyPanel management interface until a fixed version or vendor guidance is available","reach":"internet","title":"Akuvox HyPanel PS51: login flaw allows improper authentication remotely","impact":"high","summary":"Akuvox Akubela HyPanel PS51 version 51.130.40.26 has a weakness in its /login handler where manipulating the engrmode argument with the value admin leads to improper authentication. The sources say an attacker can trigger it remotely, and the vendor did not respond to early disclosure.","category":"infrastructure","nicknames":[],"who_cares":["akuvox","hypanel","ps51","self-hosted","iot"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker gains improper authentication to the HyPanel web login remotely","analyst_note":"Confirm the affected version range, any vendor advisory or patch, and whether the engrmode bypass is reachable on default configuration; NVD entry: https://nvd.nist.gov/vuln/detail/CVE-2026-116371","how_to_check":"- Check whether the device or panel runs `51.130.40.26` of HyPanel PS51 (the version is shown in the admin interface; exact location unknown)\n- Check whether `/login` on the HyPanel web interface accepts an `engrmode` parameter set to `admin` (unknown from sources)","needs_analyst":true,"not_affected_if":["other-versions","no-network-exposure"],"who_is_affected":"Teams running Akuvox Akubela HyPanel PS51 at version 51.130.40.26 with a web login reachable from the network are the ones exposed. The sources do not state which deployments or configurations are affected beyond that version; systems not running this build or not exposing the login page are unlikely to be affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000675,"input_tokens":3331,"output_tokens":683,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-116371':12A,15A '-2026':11A,14A '/login':35B,89C '51.130.40.26':29B,78C 'admin':45B,100C 'akubela':25B,75C 'akuvox':1A,16B,24B,74C 'allow':6A 'argument':41B,95C 'attack':54B,107C 'authent':8A,49B,105C 'contact':115C 'cve':10A,13A 'disclosur':67B,119C 'earli':66B,116C 'element':81C 'engrmod':40B,96C 'execut':90C 'file':88C 'flaw':5A 'function':85C 'handler':36B 'host':23B 'hypanel':2A,17B,26B,76C 'identifi':72C 'impact':80C 'improp':7A,48B,104C 'infrastructur':18B 'input':99C 'iot':19B 'launch':110C 'lead':46B,102C 'login':4A 'manipul':38B,92C 'may':108C 'ps51':3A,20B,27B,77C 'remot':9A,58B,111C 'respond':64B,123C 'say':52B 'self':22B 'self-host':21B 'sourc':51B 'trigger':56B 'unknown':84C 'valu':44B 'vendor':61B,113C 'version':28B 'way':126C 'weak':32B,69C","nicknames":[],"mitigations":[],"who_affected":"Teams running Akuvox Akubela HyPanel PS51 at version 51.130.40.26 with a web login reachable from the network are the ones exposed. The sources do not state which deployments or configurations are affected beyond that version; systems not running this build or not exposing the login page are unlikely to be affected.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T17:17:26+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116371","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116371","severity":null,"published_at":"2026-10-26T17:17:26+00:00","modified_at":"2026-10-26T17:17:26+00:00","first_seen_at":"2026-10-26T17:31:22+00:00","fetched_at":"2026-10-26T17:31:22+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}