Critical · published November 19, 2025
🚨 A simple request could give an attacker full control of your Axel Technology devices! Unauthenticated access to the /cgi-bin/gstFcgi.fcgi endpoint is the sneaky key to chaos! 🔥 Think of it like a hotel with a check-in desk that has no receptionist. Anyone could walk in and access any room, throw a wild party, or even change the locks — total mayhem! If exploited, an attacker can list user accounts, create new admin users, delete existing ones, and even modify critical settings. This could lead to an absolute takeover of the device, compromising both security and functionality.
Think of it like a hotel with a check-in desk that has no receptionist. Anyone could walk in and access any room, throw a wild party, or even change the locks — total mayhem! The WOLF1MS and WOLF2MS devices (firmware versions 0.8.5 to 1.0.3) suffer from Broken Access Control due to the missing authentication mechanism at the cgi-bin endpoint, allowing unauthenticated remote attackers to perform malicious actions.
If exploited, an attacker can list user accounts, create new admin users, delete existing ones, and even modify critical settings. This could lead to an absolute takeover of the device, compromising both security and functionality. To secure your devices, patch immediately to firmware version 1.0.4 or higher. Ensure that all access controls are properly configured and restrict access to sensitive endpoints. Review user account permissions and settings to prevent unauthorized changes. You've got this! Follow the steps above, and you'll restore security in no time! 🛡️