Critical · published November 19, 2025
🚨 Unauthenticated access is the entire exploit! Attackers can outright control Axel Technology's Puma devices simply by reaching the /cgi-bin/gstFcgi.fcgi endpoint. 🔥 Think of it like a restaurant with a backdoor that anyone can use to walk in, change the menu, or even kick out the chef without ever paying for a meal. That's how easy it is for an attacker to wreak havoc here! If exploited, an attacker could list all user accounts, create new admin users, delete existing ones, and modify critical system settings. This isn't just a breach; it's a total takeover of the device that could compromise the entire network it's connected to!
Think of it like a restaurant with a backdoor that anyone can use to walk in, change the menu, or even kick out the chef without ever paying for a meal. That's how easy it is for an attacker to wreak havoc here! This is a Broken Access Control vulnerability affecting firmware versions 0.8.5 to 1.0.3 of Axel Technology's Puma devices, stemming from a lack of authentication on a key CGI endpoint.
If exploited, an attacker could list all user accounts, create new admin users, delete existing ones, and modify critical system settings. This isn't just a breach; it's a total takeover of the device that could compromise the entire network it's connected to! Immediately update to firmware version 1.0.4 or later to close this security gap. Additionally, review your device configurations and restrict access to sensitive endpoints. Regular audits can help maintain your defenses! You've got this! With these steps, your devices will be locked down and secure in no time. 🛡️