CVE-2026-1341: Avation Light Engine Pro - Missing Authentication for Critical Function
CVE-2026-1341 affects the Avation Light Engine Pro, whose configuration and control interface is exposed without authentication or access control. The CNA record shows a CVSS 4.0 score of 9.3 (critical) and maps the weakness to CWE-306. The available record does not list affected versions, fixed versions, or inclusion in the CISA KEV catalog.
Overview
CVE-2026-1341 is recorded for the Avation Light Engine Pro. According to the description, its configuration and control interface is exposed without any authentication or access control. The weakness is classified as CWE-306 (Missing Authentication for Critical Function). The CNA is ICS-CERT, and the reference list points to CISA ICS advisory ICSA-26-034-02 (CISA advisory).
Impact
- The CVSS 4.0 vector in the record describes a network-reachable attack with low complexity, no privileges and no user interaction, with high impact on confidentiality, integrity and availability. This reading of the vector is an inference.
- Because the interface lacks authentication, a party that can reach it over the network could potentially view or change settings. This follows from CWE-306 and is an inference, not a confirmed outcome.
Affected products and versions
The record contains no list of affected versions and no list of fixed versions. The affected range is unknown from the data consulted. Do not assume that every release is vulnerable or that any release is safe; check the vendor contact (vendor contact page) and the CISA advisory.
Exploitation status
The record shows that this CVE is not listed in the CISA Known Exploited Vulnerabilities catalog. No confirmed exploitation appears in the sources consulted for this analysis.
Remediation and mitigation
- Inventory all Light Engine Pro deployments and determine whether their configuration and control interfaces can be reached from untrusted networks.
- Restrict access to management interfaces through network segmentation, firewall rules and allowlists, and route administrative access through controlled channels such as a VPN or a hardened jump host.
- Ask the vendor for patch or configuration guidance, since the record contains no fix. Use the vendor contact page for this purpose.
- Follow the guidance in the CISA advisory and review the NVD entry for updates.
- Where the product offers any authentication or access restriction setting, verify that it is enabled.
Detection guidance
- Review network traffic and logs for connections to configuration or control interfaces from sources that are not authorized administrators.
- Track unexpected configuration changes on the device and correlate them with administrative activity records.
- Alert on access attempts from outside the expected management network segments.
Limitations of the available information
The record does not include affected or fixed versions, KEV details beyond the absence of a listing, EPSS, SSVC, or vendor-side technical details. The CISA advisory and its CSAF file are referenced, but their contents were not part of the record, so their specifics remain unknown here.
Frequently asked questions
What is the core issue in CVE-2026-1341?
According to the record, the configuration and control interface of Avation Light Engine Pro is exposed without authentication or access control, which maps to CWE-306.
Is there a confirmed fix or known exploitation?
The record lists no fixed versions and does not list the CVE in the CISA KEV catalog. No confirmed exploitation appears in the sources consulted, so administrators should contact the vendor and restrict network access meanwhile.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.