Critical · published November 19, 2025
🚨 An attacker can gain Superuser access just by tweaking the response from a single API call! 🔥 This vulnerability is like handing someone a master key that unlocks all the rooms in a hotel — they can manipulate the check-in process to gain access without any valid ID. Just a small alteration can let them skip the front desk entirely! If exploited, this flaw allows malicious users to waltz into the system as Superusers or Operators, wreaking havoc by bypassing authentication entirely—reading sensitive data, changing settings, or more devastating actions. It's a security nightmare that could lead to data breaches and severe system manipulation!
This vulnerability is like handing someone a master key that unlocks all the rooms in a hotel — they can manipulate the check-in process to gain access without any valid ID. Just a small alteration can let them skip the front desk entirely! This vulnerability allows attackers to modify intercepted responses from the /celoxservice endpoint in Newtec Celox UHD devices, specifically during the loginWithUserName flow, enabling unauthorized access without valid credentials.
If exploited, this flaw allows malicious users to waltz into the system as Superusers or Operators, wreaking havoc by bypassing authentication entirely—reading sensitive data, changing settings, or more devastating actions. It's a security nightmare that could lead to data breaches and severe system manipulation! To protect your devices, immediately update the firmware from celox-21.6.13 to the latest version available. Ensure your network protocols enforce strict validation on responses and consider implementing additional layers of security, like intrusion detection systems. Don't wait! You've got this! With these steps, you can lock down your systems and keep the bad actors at bay! 🛡️