CVE Intelligence
Analysis AI-assisted

CVE-2026-3356: MS27102A Remote Spectrum Monitor Authentication Bypass

CVE-2026-3356 is an authentication bypass in the MS27102A Remote Spectrum Monitor that lets unauthorized users reach and change its management interface. The record states the device has no way to enable or configure authentication, and ICS-CERT rates it 9.3 critical under CVSS 4.0. No fix or affected version list is provided, and the issue is not listed in CISA KEV.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2026-3356 affects the MS27102A Remote Spectrum Monitor. Its management interface can be reached and changed by unauthorized users because of an authentication bypass. The record states the device offers no way to enable or configure authentication, so the weakness is described as a design issue rather than a deployment error. It is mapped to CWE-306, Missing Authentication for Critical Function. ICS-CERT published advisory ICSA-26-090-01.

Impact

  • ICS-CERT assigns a CVSS 4.0 base score of 9.3 (critical), with network attack vector, no privileges required, no user interaction, and high impact on the confidentiality, integrity and availability of the vulnerable system.
  • Unauthorized users could access and manipulate the device's management interface.

Affected products and versions

  • The record names the product as MS27102A Remote Spectrum Monitor.
  • The record contains no affected version ranges; the affected list is empty.
  • The record lists no fixed versions. This does not mean that no fix exists.

Exploitation status

  • The record shows this CVE is not listed in CISA KEV.
  • No confirmed exploitation appears in the sources consulted.
  • The record reports an EPSS probability of 0.00577 and a percentile of 0.46016. These are statistical estimates and do not indicate that exploitation has occurred.

Remediation and mitigation

  • Check the device vendor's channels and the CISA advisory for firmware or design updates.
  • Restrict network access to the management interface and keep the device on segmented networks reachable only from trusted hosts.
  • Where the architecture allows, place access behind controlled paths such as VPN gateways or managed jump hosts.
  • Inventory every instance of the device and confirm whether any management interface is reachable from outside trusted networks.

Detection guidance

  • Monitor traffic to the device management interface and investigate connections from unexpected sources.
  • Review available logs for configuration changes made from unknown addresses.
  • Alert on configuration changes made outside approved maintenance windows.

Limitations of the available information

  • The record does not name the vendor, affected versions, fixed versions or patch status.
  • The record contains no further advisory detail beyond the cited reference.
  • The EPSS date in the record is 2026-10-13, which should be checked against current data.
  • The record includes no data on internet exposure of this device.

Frequently asked questions

What is the core weakness in CVE-2026-3356?

The record describes an authentication bypass that lets unauthorized users access and manipulate the management interface of the MS27102A Remote Spectrum Monitor. It also states the device provides no mechanism to enable or configure authentication, which places the issue in the device design.

Is there a confirmed fix for this vulnerability?

The record lists no fixed versions and no patches. The absence of listed fixes does not mean none exist, so check the CISA advisory and the vendor's channels for updates.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.