{"id":"CVE-2026-126759","kind":"vulnerability","aliases":["CVE-2026-126759"],"related":[],"title":"H3C ICG2000 gateway: web management page lacks authentication, remote attack","description":"A flaw has been found in H3C ICG2000 Unified Communication Gateway 2023. This issue affects some unknown processing of the file /wnm/check.j of the component Web Management Module. Executing a manipulation can lead to missing authentication. The attack may be performed from remote. The exploit has been published and may be used. The researcher claims that the vendor has acknowledged receipt of the vulnerability report. No further response has been received.","summary":"A flaw in the Web Management Module of the H3C ICG2000 Unified Communication Gateway 2023 lets a remote attacker reach the file /wnm/check.j without authentication. A public exploit has been published, and the vendor has acknowledged the report but has not released a fix.","severity":"medium","cvss":5.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["h3c","icg2000","infrastructure","network-appliance","unified-communications"],"not_affected_if":["management-interface-not-exposed","no-icg2000-deployed"],"how_to_check":"- Check whether the H3C ICG2000 gateway is running a 2023 build and whether its web management interface is reachable from the internet or untrusted networks.","fix":null,"status":"open","published_at":"2026-11-12T00:17:14+00:00","first_seen_at":"2026-11-12T00:39:17+00:00","triaged_at":"2026-11-12T00:40:17+00:00","updated_at":"2026-11-12T00:40:17+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-12T00:40:17Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"H3C ICG2000 gateway: web management page lacks authentication, remote attack","impact":"medium","summary":"A flaw in the Web Management Module of the H3C ICG2000 Unified Communication Gateway 2023 lets a remote attacker reach the file /wnm/check.j without authentication. A public exploit has been published, and the vendor has acknowledged the report but has not released a fix.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["h3c","icg2000","unified-communications","network-appliance"],"confidence":0.6,"fix_status":"none","needs_auth":"no","worst_case":"Unauthenticated remote access to gateway management functions","analyst_note":"Check NVD and the vendor advisory for affected versions and whether a fix exists; the public exploit status suggests urgency.","how_to_check":"- Check whether the H3C ICG2000 gateway is running a 2023 build and whether its web management interface is reachable from the internet or untrusted networks.\n- unknown for a specific version check; the sources do not list affected or fixed versions.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-icg2000-deployed","management-interface-not-exposed"],"who_is_affected":"Organisations running the H3C ICG2000 Unified Communication Gateway 2023 with its web management interface exposed. The sources do not say whether default configuration is affected. Teams with no ICG2000 deployment can skip it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000746,"input_tokens":4586,"output_tokens":575,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-126759':13A,16A '-2026':12A,15A '/wnm/check.j':48B,91C '2023':40B,81C 'acknowledg':61B,129C 'affect':84C 'applianc':22B 'attack':10A,44B,107C 'authent':8A,50B,105C 'claim':124C 'communic':25B,38B,79C 'compon':94C 'cve':11A,14A 'execut':98C 'exploit':53B,114C 'file':47B,90C 'fix':69B 'flaw':27B,71C 'found':74C 'gateway':3A,39B,80C 'h3c':1A,17B,35B,76C 'icg2000':2A,18B,36B,77C 'infrastructur':19B 'issu':83C 'lack':7A 'lead':102C 'let':41B 'manag':5A,31B,96C 'manipul':100C 'may':108C,119C 'miss':104C 'modul':32B,97C 'network':21B 'network-appli':20B 'page':6A 'perform':110C 'process':87C 'public':52B 'publish':56B,117C 'reach':45B 'receipt':130C 'receiv':140C 'releas':67B 'remot':9A,43B,112C 'report':63B,134C 'research':123C 'respons':137C 'unifi':24B,37B,78C 'unified-commun':23B 'unknown':86C 'use':121C 'vendor':59B,127C 'vulner':133C 'web':4A,30B,95C 'without':49B","nicknames":[],"mitigations":[],"who_affected":"Organisations running the H3C ICG2000 Unified Communication Gateway 2023 with its web management interface exposed. The sources do not say whether default configuration is affected. Teams with no ICG2000 deployment can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["h3c","icg2000","infrastructure","medium","networkappliance","unifiedcommunications"],"campaign_type":null,"search_a":"'-126759':13A,16A '-2026':12A,15A 'attack':10A 'authent':8A 'cve':11A,14A 'gateway':3A 'h3c':1A 'icg2000':2A 'lack':7A 'manag':5A 'page':6A 'remot':9A 'web':4A","search_b":"'/wnm/check.j':48B '2023':40B 'acknowledg':61B 'applianc':22B 'attack':44B 'authent':50B 'communic':25B,38B 'exploit':53B 'file':47B 'fix':69B 'flaw':27B 'gateway':39B 'h3c':17B,35B 'icg2000':18B,36B 'infrastructur':19B 'let':41B 'manag':31B 'modul':32B 'network':21B 'network-appli':20B 'public':52B 'publish':56B 'reach':45B 'releas':67B 'remot':43B 'report':63B 'unifi':24B,37B 'unified-commun':23B 'vendor':59B 'web':30B 'without':49B","search_c":"'/wnm/check.j':91C '2023':81C 'acknowledg':129C 'affect':84C 'attack':107C 'authent':105C 'claim':124C 'communic':79C 'compon':94C 'execut':98C 'exploit':114C 'file':90C 'flaw':71C 'found':74C 'gateway':80C 'h3c':76C 'icg2000':77C 'issu':83C 'lead':102C 'manag':96C 'manipul':100C 'may':108C,119C 'miss':104C 'modul':97C 'perform':110C 'process':87C 'publish':117C 'receipt':130C 'receiv':140C 'remot':112C 'report':134C 'research':123C 'respons':137C 'unifi':78C 'unknown':86C 'use':121C 'vendor':127C 'vulner':133C 'web':95C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T00:17:14+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126759","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126759","severity":null,"published_at":"2026-11-12T00:17:14+00:00","modified_at":"2026-11-12T00:17:14+00:00","first_seen_at":"2026-11-12T00:39:17+00:00","fetched_at":"2026-11-12T00:39:17+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}