CVE-2026-2417CWE-306

Missing Authentication for Critical Function in Pharos Controls Mosaic Show Controller

Critical · published March 24, 2026

CVSS v4.0
9.3
EPSS
1%
Percentile
47.8
In the wild
Unconfirmed
What it is

A Missing Authentication for Critical Function vulnerability in Pharos Controls Mosaic Show Controller firmware version 2.15.3 could allow an unauthenticated attacker to bypass authentication and execute arbitrary commands with root privileges.

The record
Technical detail
CVSS v4.0
9.3 · CRITICAL
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00595 · 47.8th percentile
Weakness
CWE-306 · Missing Authentication for Critical Function
Published
2026-03-24T18:06Z
EPSS history
Timeline
  • 24 MAR 18:06Z
    Missing Authentication for Critical Function in Pharos Controls Mosaic Show Controller
    cvelistv5