Microchip IStaX implements a per-device cookie secret that is stored in the webstax_auth session cookie. An authenticated low‑privileged user can retrieve this cookie secret from their own session cookie and use it to forge a cookie that grants administrative privileges. The vulnerability is a weakness of authentication enforcement (CWE‑331) and allows an attacker who has already authenticated to elevate privileges to administrator level, providing full control over the device. The impact is a clear loss of integrity and confidentiality of the device’s configuration and data.

Devices running Microchip IStaX firmware dated before the 2026.03 release are affected. The vulnerability does not affect later releases that include the hardening of the cookie authentication mechanism.

The CVSS score is 8.7, indicating a high severity vulnerability. While an EPSS score is not available, the lack of a KEV listing does not negate the risk; Microchip’s recommendation to restrict management access until an upgrade suggests the risk of exploitation is considered significant. The likely attack vector is via the device’s web management interface, meaning any party that can authenticate, even with low privileges, can leverage the flaw. Successful exploitation requires only a valid low‑privilege account and no special network infrastructure beyond access to the web interface.