CVE-2026-1632: MOMA Seismic Station Missing Authentication on Web Management Interface
CVE-2026-1632 affects MOMA Seismic Station version v2.4.2520 and prior, where the web management interface does not require authentication. According to the record, an unauthenticated attacker could modify configuration, acquire device data or remotely reset the device. The record reports a CVSS 3.1 base score of 9.1 (critical) and a CVSS 4.0 score of 9.3, both from CISA ICS-CERT.
Overview
CVE-2026-1632 is a missing-authentication weakness (CWE-306) in the web management interface of the MOMA Seismic Station, version v2.4.2520 and prior. The CNA, CISA ICS-CERT, published the record on 2026-02-03 and the CVE entry is marked as Deferred in the consulted record.
Impact
According to the record, an unauthenticated remote attacker could modify configuration settings, acquire device data or remotely reset the device. The CVSS 3.1 vector reported (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) indicates network reach, low complexity, no privileges and no user interaction, with high confidentiality and integrity impact and no reported availability impact in that vector, although the description mentions remote reset.
Affected products and versions
- MOMA Seismic Station, version v2.4.2520 and prior, as stated in the description.
- The structured affected-product list in the record is empty, so exact product identifiers and additional versions are not confirmed beyond the description.
Exploitation status
The CISA KEV catalog does not list this CVE in the record consulted. No confirmed exploitation appears in the sources consulted.
Remediation and mitigation
The record does not list a fixed version. The absence of a fixed version in the record does not mean no fix exists; consult the CISA advisory ICSA-26-034-03 for vendor guidance. Defensive steps while awaiting an update include restricting network access to the management interface to trusted administrative networks, placing the device behind segmentation or a firewall, and avoiding direct exposure to the internet.
Detection guidance
- Inventory seismic stations and identify any running version v2.4.2520 or earlier.
- Review network logs for unexpected access to the management web interface from untrusted sources.
- Monitor for unexplained configuration changes or unplanned device restarts.
Limitations of the available information
The record does not provide a vendor-specific fixed version, a product list beyond the description, KEV data, EPSS or SSVC scores. Details of the advisory content were not available in the record itself, so this analysis relies on the description and the CVSS data.
Frequently asked questions
What is the core weakness in CVE-2026-1632?
The web management interface of the MOMA Seismic Station, version v2.4.2520 and prior, does not require authentication, classified as CWE-306 Missing Authentication for Critical Function.
Is there a confirmed fix for CVE-2026-1632?
The record does not list a fixed version. Check the CISA advisory ICSA-26-034-03 for vendor guidance.
Is CVE-2026-1632 known to be exploited?
The CVE is not listed in the CISA KEV catalog in the record consulted, and no confirmed exploitation appears in the sources consulted.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.