CVE-2026-1341 - Vulnerability Details - OpenCVE

Avation Light Engine Pro exposes its configuration and control interface without any authentication or access control.

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Avation	Light Engine Pro

No data.

No data.

References

Link	Providers
https://www.cisa.gov/news-events/ics-advisories/icsa-26-034-02

History

Wed, 04 Feb 2026 12:15:00 +0000

Type	Values Removed	Values Added
First Time appeared		Avation Avation light Engine Pro
Vendors & Products		Avation Avation light Engine Pro

Tue, 03 Feb 2026 21:45:00 +0000

Type	Values Removed	Values Added
Description		Avation Light Engine Pro exposes its configuration and control interface without any authentication or access control.
Title		Missing Authentication for Critical Function in Avation Light Engine Pro
Weaknesses		CWE-306
References		https://www.cisa.gov/news-events/ics-advisories/icsa-26-034-02
Metrics		cvssV4_0 `{'score': 9.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}`

MITRE

Status: PUBLISHED

Assigner: icscert

Published: 2026-02-03T21:26:41.708Z

Updated: 2026-02-04T16:47:32.531Z

Reserved: 2026-01-22T15:06:19.135Z

Link: CVE-2026-1341

Vulnrichment

No data.

NVD

Status : Awaiting Analysis

Published: 2026-02-03T22:16:29.517

Modified: 2026-02-04T16:33:44.537

Link: CVE-2026-1341

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-1341", "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "state": "PUBLISHED", "assignerShortName": "icscert", "dateReserved": "2026-01-22T15:06:19.135Z", "datePublished": "2026-02-03T21:26:41.708Z", "dateUpdated": "2026-02-04T16:47:32.531Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Avation Light Engine Pro", "vendor": "Avation", "versions": [{"status": "affected", "version": "All"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Souvik Kandar reported this vulnerability to CISA"}], "datePublic": "2026-02-03T17:00:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<span style=\"background-color: rgb(255, 255, 255);\">Avation Light Engine Pro exposes its configuration and control interface without any authentication or access control.</span>"}], "value": "Avation Light Engine Pro exposes its configuration and control interface without any authentication or access control."}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 9.3, "baseSeverity": "CRITICAL", "exploitMaturity": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-306", "description": "CWE-306 Missing Authentication for Critical Function", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "shortName": "icscert", "dateUpdated": "2026-02-03T21:26:41.708Z"}, "references": [{"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-034-02"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<span style=\"background-color: rgb(245, 250, 252);\">Avation has not responded to CISA's request to coordinate. Users of Avation Light Engine Pro are encouraged to contact Avation for more information.</span>\n\n<br>"}], "value": "Avation has not responded to CISA's request to coordinate. Users of Avation Light Engine Pro are encouraged to contact Avation for more information."}], "source": {"discovery": "UNKNOWN"}, "title": "Missing Authentication for Critical Function in Avation Light Engine Pro", "x_generator": {"engine": "Vulnogram 0.5.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-04T16:46:08.187019Z", "id": "CVE-2026-1341", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-04T16:47:32.531Z"}}]}}