Critical · published February 11, 2026
🚨 With just a crafty cookie, an attacker can waltz right past authentication in the ZBT WE2001! 🔥 Imagine a restaurant where the staff hands out keys to the kitchen without checking reservations. This path traversal vulnerability lets hackers provide their own session cookie, bypassing all security measures and accessing sensitive admin functions. This means an attacker could take complete control of the device—alter settings, view private configurations, or even shut down critical services. The consequences could range from a minor inconvenience to an absolute disaster if exploited in a vulnerable environment.
Imagine a restaurant where the staff hands out keys to the kitchen without checking reservations. This path traversal vulnerability lets hackers provide their own session cookie, bypassing all security measures and accessing sensitive admin functions. The vulnerability in the check_token function allows remote attackers to manipulate session cookies to bypass authentication entirely, enabling unauthorized administrative actions without needing valid credentials.
This means an attacker could take complete control of the device—alter settings, view private configurations, or even shut down critical services. The consequences could range from a minor inconvenience to an absolute disaster if exploited in a vulnerable environment. Update the firmware to version 23.09.28 or later immediately. Additionally, review and restrict session management practices to prevent unauthorized access through cookie manipulation. You've got this! By patching promptly, you can secure your systems and keep those hackers at bay! 🛡️