CVE Intelligence
Analysis AI-assisted

CVE-2026-24728: Interinfo DreamMaker - Missing Authentication on Administrative Endpoint

Interinfo DreamMaker versions before 2025/10/22 expose administrative functionality through the /servlet/baServer3 endpoint without requiring authentication, as tracked in CVE-2026-24728 (CWE-306). The CNA ART@zuso.ai assigned a CVSS 4.0 base score of 9.3. The record lists no affected product entries or fixed versions, so organizations should verify their exposure against the vendor advisory.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2026-24728 is classified as CWE-306, missing authentication for a critical function. According to the record, the /servlet/baServer3 endpoint of Interinfo DreamMaker versions before 2025/10/22 exposes administrative functionality that can be reached without prior authentication. The CVE was published on 2026-01-30 by the CNA ART@zuso.ai, and the record status is Deferred.

Impact

The CNA scored the issue 9.3 under CVSS 4.0 (critical). The vector in the record indicates a network attack vector, low complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity and availability of the vulnerable component. In practical terms, an exposed administrative function reachable without login can allow unauthorized changes to the product or its data, but the record does not describe the specific actions possible.

Affected products and versions

  • The record describes affected versions as those before 2025/10/22 of Interinfo DreamMaker.
  • The structured affected-product list in the record is empty, so exact product names, builds and platforms are unknown.
  • No fixed version is listed in the record.

Exploitation status

The record shows that the CVE is not listed in the CISA KEV catalog. No confirmed exploitation appears in the sources consulted for this analysis. The EPSS score is not available in the record.

Remediation and mitigation

  • Consult the vendor advisory at zuso.ai advisory ZA-2026-01 for fixed builds and upgrade guidance.
  • Inventory all Interinfo DreamMaker instances and confirm whether they are older than 2025/10/22.
  • Until a fix is applied, restrict network access to administrative interfaces to trusted management networks, for example through segmentation or access control lists.
  • Do not expose DreamMaker management endpoints directly to the internet.

Detection guidance

  • Review web server and application logs for requests to the /servlet/baServer3 path originating from unexpected sources.
  • Monitor for unexpected administrative configuration changes or new accounts in DreamMaker.
  • Compare exposed services against an asset inventory to find instances reachable from outside the trusted network.

Limitations of the available information

  • The record has no affected product list, no fixed versions and no vendor-supplied fix details.
  • EPSS and SSVC data are absent.
  • The exact functions reachable through the endpoint are not described.
  • The record status is Deferred, so further analysis may change the data.

Frequently asked questions

What is CVE-2026-24728?

It is a missing authentication vulnerability (CWE-306) in the /servlet/baServer3 endpoint of Interinfo DreamMaker versions before 2025/10/22, according to the record.

Is this vulnerability confirmed to be exploited?

The record shows it is not listed in CISA KEV, and no confirmed exploitation appears in the sources consulted.

Which version is fixed?

The record does not list a fixed version. Check the vendor advisory at zuso.ai for upgrade guidance.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.