{"id":"CVE-2026-70381","kind":"vulnerability","aliases":["CVE-2026-70381"],"related":[],"title":"Web server config exposes on-device-only resources to unauthenticated network users","description":"An access-control vulnerability has been identified in the web server configuration. Some resources intended for on-device use only could be accessed remotely by an unauthenticated attacker with network access to the web interface.\nThe accessible resources do not expose credentials or provide administrative functionality, but may include non-public device content, such as screen-saver content or assets used by the web interface.","summary":"A web server configuration flaw lets unauthenticated attackers on the network fetch resources meant only for on-device use. The exposed files reportedly include screen-saver content and web interface assets, not credentials or admin functions.","severity":"medium","cvss":6.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["embedded-web-interface","infrastructure","network-devices"],"not_affected_if":["auth-required","internal-only-network"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-26T20:18:35+00:00","first_seen_at":"2026-10-26T20:50:18+00:00","triaged_at":"2026-10-26T20:51:40+00:00","updated_at":"2026-10-26T20:51:40+00:00","category":"infrastructure","confidence":0.4,"triage":{"at":"2026-10-26T20:51:40Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Web server config exposes on-device-only resources to unauthenticated network users","impact":"low","summary":"A web server configuration flaw lets unauthenticated attackers on the network fetch resources meant only for on-device use. The exposed files reportedly include screen-saver content and web interface assets, not credentials or admin functions.","category":"infrastructure","nicknames":[],"who_cares":["embedded-web-interface","network-devices"],"confidence":0.4,"needs_auth":"no","worst_case":"Non-public device assets readable remotely; no credentials exposed","analyst_note":"Identify the affected product and firmware versions from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-70381 and find the vendor advisory.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["auth-required","internal-only-network"],"who_is_affected":"The sources do not name the affected product or firmware. Teams running network devices with an embedded web interface should check whether that interface is reachable from untrusted networks. Teams without such devices can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000545,"input_tokens":3312,"output_tokens":427,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,18A '-70381':16A,19A 'access':68C,90C,98C,104C 'access-control':67C 'admin':64B 'administr':112C 'asset':60B,129C 'attack':35B,95C 'config':3A 'configur':31B,78C 'content':56B,121C,127C 'control':69C 'could':88C 'credenti':62B,109C 'cve':14A,17A 'devic':7A,27B,46B,85C,120C 'embed':21B 'embedded-web-interfac':20B 'expos':4A,49B,108C 'fetch':39B 'file':50B 'flaw':32B 'function':65B,113C 'identifi':73C 'includ':52B,116C 'infrastructur':24B 'intend':81C 'interfac':23B,59B,102C,134C 'let':33B 'may':115C 'meant':41B 'network':12A,26B,38B,97C 'network-devic':25B 'non':118C 'non-publ':117C 'on-devic':44B,83C 'on-device-on':5A 'provid':111C 'public':119C 'remot':91C 'report':51B 'resourc':9A,40B,80C,105C 'saver':55B,126C 'screen':54B,125C 'screen-sav':53B,124C 'server':2A,30B,77C 'unauthent':11A,34B,94C 'use':47B,86C,130C 'user':13A 'vulner':70C 'web':1A,22B,29B,58B,76C,101C,133C","nicknames":[],"mitigations":[],"who_affected":"The sources do not name the affected product or firmware. Teams running network devices with an embedded web interface should check whether that interface is reachable from untrusted networks. Teams without such devices can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T20:18:35+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-70381","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70381","severity":null,"published_at":"2026-10-26T20:18:35+00:00","modified_at":"2026-10-26T20:18:35+00:00","first_seen_at":"2026-10-26T20:50:18+00:00","fetched_at":"2026-10-26T20:50:18+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}