CVE-2026-8185

UGREEN CM933 Administrative missing authentication

View on CVE.org
Published May 9, 2026 CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Description
A security vulnerability has been detected in UGREEN CM933 1.1.59.4319. The impacted element is an unknown function of the component Administrative Interface. Such manipulation leads to missing authentication. The attack requires being on the local network. You should upgrade the affected component. The vendor replied: "We have successfully confirmed and reproduced the issue. We take this matter very seriously and have incorporated the fix into our development schedule. The issue is scheduled to be resolved in the release version coming in late April."

Analysis

AI-generated

Technical impact

The vulnerability manifests as a missing authentication requirement for an unknown function within the administrative interface of UGREEN CM933. Because authorization is not enforced, an attacker who connects to the device from the same local network can log in to the administrative console without credentials, giving them full control over the device’s configuration and potentially exposing sensitive information. The weakness is classified under CWE‑287 and CWE‑306, indicating broken authentication and missing authorization controls.

Affected Systems

UGREEN CM933 firmware version 1.1.59.4319 is affected. No other versions or products have been reported as vulnerable; the vendor confirms the issue only in this build.

Risk and Exploitability

The CVSS vector gives a score of 5.3, reflecting moderate severity due to the local‑network requirement. EPSS is not available, and the vulnerability is not listed in CISA’s KEV catalog, suggesting that it has not yet been widely exploited. Attackers would need physical or network proximity to the device, but once local access is achieved, they can gain unrestricted administrative privileges with no additional conditions.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the firmware update for CM933 once the vendor releases the fixed version scheduled for late April.
  • Limit the device’s administrative interface to trusted network segments or use firewall rules to prevent unauthorized local devices from reaching it.
  • Monitor the vendor’s advisory page or product support for patch availability and apply when the new firmware is distributed.

Generated by OpenCVE AI on May 9, 2026 at 11:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
First Time appeared Ugreen
Ugreen cm933
Vendors & Products Ugreen
Ugreen cm933
Type Values Removed Values Added
Description A security vulnerability has been detected in UGREEN CM933 1.1.59.4319. The impacted element is an unknown function of the component Administrative Interface. Such manipulation leads to missing authentication. The attack requires being on the local network. You should upgrade the affected component. The vendor replied: "We have successfully confirmed and reproduced the issue. We take this matter very seriously and have incorporated the fix into our development schedule. The issue is scheduled to be resolved in the release version coming in late April."
Title UGREEN CM933 Administrative missing authentication
Weaknesses CWE-287
CWE-306
References
Metrics cvssV2_0

{'score': 5.8, 'vector': 'AV:A/AC:L/Au:N/C:P/I:P/A:P/E:ND/RL:OF/RC:C'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X'}
Weaknesses
  • CWE-287

    Improper Authentication

  • CWE-306

    Missing Authentication for Critical Function

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
May 12, 2026, 2:25 AM
Reserved
May 8, 2026, 7:40 PM

View source JSON

Updated
May 12, 2026, 2:25 AM

JSON

Status
Deferred
Published
May 9, 2026, 11:16 AM
Modified
Jul 24, 2026, 8:10 AM

View source JSON

No data.

Updated
May 10, 2026, 9:24 PM

JSON