{"id":"CVE-2026-124578","kind":"vulnerability","aliases":["CVE-2026-124578"],"related":[],"title":"Pantum BP5100DW printer: web interface lets remote users skip authentication","description":"A security vulnerability has been detected in Pantum BP5100DW 3.A.4.7. The impacted element is an unknown function of the file /shtml/omDB.shtml of the component Web Interface. The manipulation leads to missing authentication. The attack may be initiated remotely. The vendor was contacted early about this disclosure but did not respond in any way.","summary":"The Pantum BP5100DW printer firmware 3.A.4.7 has a flaw in an unknown function of its web interface file /shtml/omDB.shtml that lacks authentication. A remote attacker can reach that page without logging in.","severity":"medium","cvss":6.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["firmware","infrastructure","pantum","printer","web-interface"],"not_affected_if":["no-network-access","other-firmware-version"],"how_to_check":"- Check the printer's firmware version in its web admin page or on its settings panel against `3.A.4.7`\n- Test whether `/shtml/omDB.shtml` answers without a login from the network segment where the printer sits","fix":null,"status":"open","published_at":"2026-11-09T08:17:02+00:00","first_seen_at":"2026-11-09T08:25:21+00:00","triaged_at":"2026-11-09T08:25:51+00:00","updated_at":"2026-11-09T08:25:51+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-09T08:25:51Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Pantum BP5100DW printer: web interface lets remote users skip authentication","impact":"medium","summary":"The Pantum BP5100DW printer firmware 3.A.4.7 has a flaw in an unknown function of its web interface file /shtml/omDB.shtml that lacks authentication. A remote attacker can reach that page without logging in.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["pantum","printer","web-interface","firmware"],"confidence":0.5,"fix_status":"unknown","needs_auth":"no","worst_case":"Remote attacker reaches printer web functions without any login","analyst_note":"Confirm the fix status and whether the vendor has since released firmware; check the NVD entry for the affected function and any vendor advisory.","how_to_check":"- Check the printer's firmware version in its web admin page or on its settings panel against `3.A.4.7`\n- Test whether `/shtml/omDB.shtml` answers without a login from the network segment where the printer sits","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["other-firmware-version","no-network-access"],"who_is_affected":"Organizations running a Pantum BP5100DW printer on firmware 3.A.4.7 with its web interface reachable from the network are exposed. Printers kept off the network or behind login-protected access can skip this for now. The sources do not say whether the vendor has released a patch, and the vendor did not respond to disclosure.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000743,"input_tokens":4562,"output_tokens":573,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-124578':13A,16A '-2026':12A,15A '/shtml/omdb.shtml':43B,77C '3':29B,65C 'a.4.7':30B,66C 'attack':49B,90C 'authent':10A,46B,88C 'bp5100dw':2A,26B,64C 'compon':80C 'contact':98C 'cve':11A,14A 'detect':61C 'disclosur':102C 'earli':99C 'element':69C 'file':42B,76C 'firmwar':17B,28B 'flaw':33B 'function':37B,73C 'impact':68C 'infrastructur':18B 'initi':93C 'interfac':5A,23B,41B,82C 'lack':45B 'lead':85C 'let':6A 'log':55B 'manipul':84C 'may':91C 'miss':87C 'page':53B 'pantum':1A,19B,25B,63C 'printer':3A,20B,27B 'reach':51B 'remot':7A,48B,94C 'respond':106C 'secur':57C 'skip':9A 'unknown':36B,72C 'user':8A 'vendor':96C 'vulner':58C 'way':109C 'web':4A,22B,40B,81C 'web-interfac':21B 'without':54B","nicknames":[],"mitigations":[],"who_affected":"Organizations running a Pantum BP5100DW printer on firmware 3.A.4.7 with its web interface reachable from the network are exposed. Printers kept off the network or behind login-protected access can skip this for now. The sources do not say whether the vendor has released a patch, and the vendor did not respond to disclosure.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["firmware","infrastructure","medium","pantum","printer","webinterface"],"campaign_type":null,"search_a":"'-124578':13A,16A '-2026':12A,15A 'authent':10A 'bp5100dw':2A 'cve':11A,14A 'interfac':5A 'let':6A 'pantum':1A 'printer':3A 'remot':7A 'skip':9A 'user':8A 'web':4A","search_b":"'/shtml/omdb.shtml':43B '3':29B 'a.4.7':30B 'attack':49B 'authent':46B 'bp5100dw':26B 'file':42B 'firmwar':17B,28B 'flaw':33B 'function':37B 'infrastructur':18B 'interfac':23B,41B 'lack':45B 'log':55B 'page':53B 'pantum':19B,25B 'printer':20B,27B 'reach':51B 'remot':48B 'unknown':36B 'web':22B,40B 'web-interfac':21B 'without':54B","search_c":"'/shtml/omdb.shtml':77C '3':65C 'a.4.7':66C 'attack':90C 'authent':88C 'bp5100dw':64C 'compon':80C 'contact':98C 'detect':61C 'disclosur':102C 'earli':99C 'element':69C 'file':76C 'function':73C 'impact':68C 'initi':93C 'interfac':82C 'lead':85C 'manipul':84C 'may':91C 'miss':87C 'pantum':63C 'remot':94C 'respond':106C 'secur':57C 'unknown':72C 'vendor':96C 'vulner':58C 'way':109C 'web':81C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T08:17:02+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124578","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124578","severity":null,"published_at":"2026-11-09T08:17:02+00:00","modified_at":"2026-11-09T08:17:02+00:00","first_seen_at":"2026-11-09T08:25:21+00:00","fetched_at":"2026-11-09T08:25:21+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}