{"id":"CVE-2026-124577","kind":"vulnerability","aliases":["CVE-2026-124577"],"related":[],"title":"Intelbras SG 2404 switch: web interface flaw allows remote improper authentication bypass","description":"A weakness has been identified in Intelbras SG 2404 PoE L2+ 1.00.70/1.00.72. The affected element is an unknown function of the file /EXCU_SHELL of the component Web Management Interface. Executing a manipulation can lead to improper authentication. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 1.00.74 is sufficient to fix this issue. Upgrading the affected component is advised.","summary":"The web management interface of the Intelbras SG 2404 PoE L2+ switch has an authentication weakness in its /EXCU_SHELL file. A remote attacker can exploit it to get past authentication, and a public exploit has been released.","severity":"critical","cvss":10.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","intelbras","network-switch","web-management"],"not_affected_if":["management-interface-isolated","other-firmware-versions"],"how_to_check":"- Check the firmware version in the switch's web management interface; versions `1.00.70` and `1.00.72` are affected\n- Confirm whether the switch's web management interface is reachable from the internet or untrusted networks","fix":"- Intelbras SG 2404 PoE L2+: upgrade to version `1.00.74`","status":"open","published_at":"2026-11-09T08:17:02+00:00","first_seen_at":"2026-11-09T08:25:21+00:00","triaged_at":"2026-11-09T08:25:51+00:00","updated_at":"2026-11-09T08:25:51+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-09T08:25:51Z","model":"claude-haiku-5-5","output":{"fix":"- Intelbras SG 2404 PoE L2+: upgrade to version `1.00.74`","reach":"internet","title":"Intelbras SG 2404 switch: web interface flaw allows remote improper authentication bypass","impact":"high","summary":"The web management interface of the Intelbras SG 2404 PoE L2+ switch has an authentication weakness in its /EXCU_SHELL file. A remote attacker can exploit it to get past authentication, and a public exploit has been released.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["intelbras","network-switch","web-management"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"Remote attacker bypasses authentication on the switch's management interface","analyst_note":"Confirm the vendor advisory and whether authentication bypass grants full admin control; check https://nvd.nist.gov/vuln/detail/CVE-2026-124577 for details.","how_to_check":"- Check the firmware version in the switch's web management interface; versions `1.00.70` and `1.00.72` are affected\n- Confirm whether the switch's web management interface is reachable from the internet or untrusted networks","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["other-firmware-versions","management-interface-isolated"],"who_is_affected":"Owners of Intelbras SG 2404 PoE L2+ switches running firmware 1.00.70 or 1.00.72 that expose the web management interface to the network or internet. Switches with the management interface isolated from untrusted networks have reduced exposure but should still be updated.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000771,"input_tokens":4617,"output_tokens":619,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-124577':15A,18A '-2026':14A,17A '/1.00.72':76C '/excu_shell':45B,87C '1.00.70':75C '1.00.74':126C '2404':3A,35B,72C 'advis':138C 'affect':78C,135C 'allow':8A 'attack':49B,103C,122C 'authent':11A,41B,56B,101C 'avail':113C 'bypass':12A 'compon':90C,136C 'could':118C 'cve':13A,16A 'element':79C 'execut':94C 'exploit':51B,60B,109C 'file':46B,86C 'fix':130C 'flaw':7A 'function':83C 'get':54B 'identifi':68C 'improp':10A,100C 'infrastructur':19B 'intelbra':1A,20B,33B,70C 'interfac':6A,30B,93C 'issu':132C 'l2':37B,74C 'launch':106C 'lead':98C 'made':112C 'manag':26B,29B,92C 'manipul':96C 'network':22B 'network-switch':21B 'past':55B 'poe':36B,73C 'public':59B,116C 'releas':63B 'remot':9A,48B,107C 'sg':2A,34B,71C 'suffici':128C 'switch':4A,23B,38B 'unknown':82C 'upgrad':123C,133C 'use':120C 'version':125C 'weak':42B,65C 'web':5A,25B,28B,91C 'web-manag':24B","nicknames":[],"mitigations":[],"who_affected":"Owners of Intelbras SG 2404 PoE L2+ switches running firmware 1.00.70 or 1.00.72 that expose the web management interface to the network or internet. Switches with the management interface isolated from untrusted networks have reduced exposure but should still be updated.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["critical","infrastructure","intelbras","networkswitch","webmanagement"],"campaign_type":null,"search_a":"'-124577':15A,18A '-2026':14A,17A '2404':3A 'allow':8A 'authent':11A 'bypass':12A 'cve':13A,16A 'flaw':7A 'improp':10A 'intelbra':1A 'interfac':6A 'remot':9A 'sg':2A 'switch':4A 'web':5A","search_b":"'/excu_shell':45B '2404':35B 'attack':49B 'authent':41B,56B 'exploit':51B,60B 'file':46B 'get':54B 'infrastructur':19B 'intelbra':20B,33B 'interfac':30B 'l2':37B 'manag':26B,29B 'network':22B 'network-switch':21B 'past':55B 'poe':36B 'public':59B 'releas':63B 'remot':48B 'sg':34B 'switch':23B,38B 'weak':42B 'web':25B,28B 'web-manag':24B","search_c":"'/1.00.72':76C '/excu_shell':87C '1.00.70':75C '1.00.74':126C '2404':72C 'advis':138C 'affect':78C,135C 'attack':103C,122C 'authent':101C 'avail':113C 'compon':90C,136C 'could':118C 'element':79C 'execut':94C 'exploit':109C 'file':86C 'fix':130C 'function':83C 'identifi':68C 'improp':100C 'intelbra':70C 'interfac':93C 'issu':132C 'l2':74C 'launch':106C 'lead':98C 'made':112C 'manag':92C 'manipul':96C 'poe':73C 'public':116C 'remot':107C 'sg':71C 'suffici':128C 'unknown':82C 'upgrad':123C,133C 'use':120C 'version':125C 'weak':65C 'web':91C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T08:17:02+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124577","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124577","severity":null,"published_at":"2026-11-09T08:17:02+00:00","modified_at":"2026-11-09T08:17:02+00:00","first_seen_at":"2026-11-09T08:25:21+00:00","fetched_at":"2026-11-09T08:25:21+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}