CVE-2026-102155

Summary

An XML External Entity (XXE) vulnerability in Spectralight's WiFi-server allows authenticated users to read arbitrary local files and cause partial denial of service by crafting malicious XML requests.

Exploitability

Exploitation requires an authenticated user account with access to the WiFi-server functionality, making it moderately difficult but not highly complex to achieve.

Blast radius

If exploited, this vulnerability could lead to sensitive configuration files, credentials, and system information disclosure across the affected network infrastructure.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Disable XML parsing functionality in the WiFi-server until a patch is available, or restrict access to the vulnerable endpoints to authenticated users only.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.