CVE-2026-77974CWE-306

CVE-2026-77974

High · published September 9, 2026

CVSS v3.1
8.0
EPSS
0%
Percentile
17.4
In the wild
Unconfirmed
What it is

After spoofing the device and obtaining one user confirmation, an attacker may be able to cause the application to transmit firmware through an unauthenticated and unsigned update channel.

The record
Technical detail
CVSS v3.1
8.0 · HIGH
Vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
8.5 · CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00265 · 17.4th percentile
Weakness
CWE-306 · Missing Authentication for Critical Function
Published
2026-09-09T20:17Z
References (1)
https://raw.githubusercontent.com/cisagov/CSAF/refs/heads/develop/csaf_files/VA/white/2026/va-26-251-01.json · [email protected]
EPSS history
Timeline
  • 11 SEP 03:19Z
    EPSS moved — → 0%
    epss
  • 09 SEP 15:41Z
    Softish C6 Ear Camera and EarVision Android Application Missing authentication for critical function
    cvelistv5