CVE-2026-1633: Synectix LAN 232 TRIO Missing Authentication on Web Management Interface
The Synectix LAN 232 TRIO 3-Port serial to ethernet adapter exposes its web management interface without requiring authentication, as described in CVE-2026-1633 (CWE-306). According to the record, an unauthenticated user could modify critical device settings or factory reset the device. The record reports a CVSS 3.1 base score of 10 and a CVSS 4.0 score of 10 from ICS-CERT, with no confirmed exploitation in the sources consulted.
Overview
CVE-2026-1633 affects the web management interface of the Synectix LAN 232 TRIO 3-Port serial to ethernet adapter. The interface does not require authentication, which is classified as CWE-306, Missing Authentication for Critical Function. The CNA is ICS-CERT, and the record was published on 2026-02-04.
Impact
According to the record, an unauthenticated user could modify critical device settings or factory reset the device. Because the record places the issue in an industrial serial-to-ethernet context, a loss of configuration or availability on such devices may affect connected serial equipment. The impact on any specific deployment is an inference and depends on how the device is used.
Affected products and versions
The record does not list affected versions or specific product builds. The affected product is identified as the Synectix LAN 232 TRIO 3-Port serial to ethernet adapter. Consult the CISA advisory for the vendor's version details.
Exploitation status
The CISA KEV catalog does not list this CVE in the record, so no confirmed active exploitation is stated in the sources consulted.
Remediation and mitigation
The record does not identify a fixed version. A missing fixed version does not mean no fix exists. Defenders should review the CISA advisory ICSA-26-034-04 for vendor guidance. At a high level, restrict network access to the management interface, keep these devices off untrusted networks, and isolate them from direct internet exposure.
Detection guidance
Review network inventories for Synectix LAN 232 TRIO devices and confirm whether their web management interfaces are reachable from networks that should not reach them. Monitor for unexpected configuration changes or unplanned resets on these devices.
Limitations of the available information
The record provides no affected version list, no fixed version, no vendor patch details, and no EPSS or SSVC data. The CVSS scores are reported by ICS-CERT. Details beyond the CISA advisory and the description were not available in the record.
Frequently asked questions
What is CVE-2026-1633?
It is a missing authentication issue (CWE-306) in the web management interface of the Synectix LAN 232 TRIO 3-Port serial to ethernet adapter, as described in the record.
Is this vulnerability being actively exploited?
The CISA KEV catalog does not list this CVE in the record, so no confirmed active exploitation appears in the sources consulted.
Which versions are affected?
The record does not list affected versions. Check the CISA advisory ICSA-26-034-04 for vendor details.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.