This vulnerability arises because the Streamable HTTP transport in genieacs-mcp creates an unauthenticated /mcp listener when the MCP_AUTH_TOKEN environment variable is not set, and in that state it fails to validate the Host or Origin headers. The weakness is a form of CWE-346, which allows an attacker to supply arbitrary header values when the service is reachable. By performing DNS rebinding, a malicious web page can force the victim’s browser to send requests to the loopback address 127.0.0.1:8080, establishing a session with the MCP server without authentication. Through this session, the attacker can enumerate and invoke operations on the GenieACS Network Binary Interface, potentially exposing or altering configuration data, triggering firmware updates, rebooting devices, and modifying TR-069 parameters, thereby gaining full control over connected equipment.

The issue affects the GenieACS MCP server distributed by GeiserX prior to version 0.3.2. The vulnerability is triggered when the application listens on the default address 127.0.0.1:8080 and MCP_AUTH_TOKEN is omitted, exposing an unauthenticated /mcp endpoint. Versions 0.3.2 and later have removed this listener and added validation of Host and Origin headers, eliminating the flaw.

The CVSS score of 8.8 reflects a high severity risk, while the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector involves a DNS rebinding attack that exploits browser handling of loopback addresses, allowing an attacker to send malicious Host and Origin headers. Because there is no authentication and no header validation, the attacker can gain unrestricted access to MCP operations, which can compromise the managed devices and the broader network.