The vulnerability manifests as a missing authentication requirement for an unknown function within the administrative interface of UGREEN CM933. Because authorization is not enforced, an attacker who connects to the device from the same local network can log in to the administrative console without credentials, giving them full control over the device’s configuration and potentially exposing sensitive information. The weakness is classified under CWE‑287 and CWE‑306, indicating broken authentication and missing authorization controls.

UGREEN CM933 firmware version 1.1.59.4319 is affected. No other versions or products have been reported as vulnerable; the vendor confirms the issue only in this build.

The CVSS vector gives a score of 5.3, reflecting moderate severity due to the local‑network requirement. EPSS is not available, and the vulnerability is not listed in CISA’s KEV catalog, suggesting that it has not yet been widely exploited. Attackers would need physical or network proximity to the device, but once local access is achieved, they can gain unrestricted administrative privileges with no additional conditions.