CVE-2026-25084CWE-306

ZLAN Information Technology ZLAN5143D Missing Authentication for Critical Function

Critical · published February 11, 2026

CVSS v4.0
9.3
EPSS
1%
Percentile
56.4
In the wild
Unconfirmed
What it is

🚨 A mere URL can unlock the vault! The ZLAN5143D's internal URLs are bypassable, leaving authentication hanging by a thread. 🔥 Think of it like a hotel with a back door that doesn't require a keycard. Anyone who finds that door can waltz right into the lobby without ever checking in! An attacker could exploit this oversight to gain unauthorized access to sensitive internal resources, potentially leading to data breaches or unauthorized control over system functions. It's like forgetting to lock the main entrance to your office while your valuables are on display!

Put simply

Think of it like a hotel with a back door that doesn't require a keycard. Anyone who finds that door can waltz right into the lobby without ever checking in! This vulnerability allows attackers to bypass authentication by directly accessing internal URLs meant for authenticated users, thus compromising the intended security protocols of the ZLAN5143D.

What to do

An attacker could exploit this oversight to gain unauthorized access to sensitive internal resources, potentially leading to data breaches or unauthorized control over system functions. It's like forgetting to lock the main entrance to your office while your valuables are on display! Immediately patch to the latest version of the ZLAN5143D firmware to close this loophole. Review your internal access controls and audit existing URLs for unnecessary exposure. Don't forget to enforce strict authentication checks! You can tackle this! Act now to secure your systems and boost your security hero status! 🛡️

The record
Technical detail
CVSS v4.0
9.3 · CRITICAL
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00806 · 56.4th percentile
Weakness
CWE-306 · Missing Authentication for Critical Function
Published
2026-02-11T16:11Z
EPSS history
Timeline
  • 11 FEB 16:11Z
    ZLAN Information Technology ZLAN5143D Missing Authentication for Critical Function
    cvelistv5