CVE-2026-124577 is a critical improper authentication vulnerability in the web management interface of the Intelbras SG 2404 PoE L2+ switch. A public exploit is available, and firmware 1.00.74 fixes the flaw.
What Is It
CVE-2026-124577 is an improper authentication weakness (CWE-287). It sits in an unspecified function of the /EXCU_SHELL file in the switch's Web Management Interface. The NVD record says that manipulating this component can lead to improper authentication, and that the attack can be launched remotely. The record does not say what access an attacker gets after a successful attack.
VulDB is the CNA and published the record on 2026-11-09. NVD lists the record's analysis status as "Deferred," so NVD has not done its own analysis.
Why It Matters
VulDB rates the flaw 9.8 (Critical) under CVSS v3.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The vector describes an attack that:
- Works over the network
- Has low attack complexity
- Needs no privileges and no user interaction
- Has high impact on confidentiality, integrity and availability
The CVSS v4.0 score is 8.9 (High), with exploit maturity set to Proof of Concept. The CVSS v2 score is 10.0.
The NVD description says the exploit "has been made available to the public and could be used for attacks." The supplied data has no CISA KEV entry, so KEV does not confirm active exploitation in the wild at this time. A public exploit exists, and VulDB's CVSS vector says no privileges are needed. Exposed management interfaces should therefore be a priority.
What's Vulnerable
- Vendor: Intelbras
- Product: SG 2404 PoE L2+
- Component: Web Management Interface (
/EXCU_SHELL) - Affected versions: 1.00.70, 1.00.72
- Unaffected version: 1.00.74
- CPE:
cpe:2.3:h:intelbras:sg_2404_poe_l2_:*:*:*:*:*:*:*:*
Patch Status
A fix is available. The NVD record says "Upgrading to version 1.00.74 is sufficient to fix this issue" and advises upgrading the affected component. Administrators on firmware 1.00.70 or 1.00.72 should upgrade to 1.00.74.
The CVE is not in CISA's Known Exploited Vulnerabilities catalog, so CISA has set no required action or due date.