CVE-2026-124577

Summary

A flaw in Intelbras SG 2404 PoE L2+ switch firmware versions 1.00.70 and 1.00.72 allows improper authentication via an unknown function in the /EXCU_SHELL web management interface, enabling remote attackers to bypass authentication controls. This critical weakness (CVSS 9.8) permits full confidentiality, integrity, and availability compromise.

Exploitability

The exploit is publicly available and requires no privileges or user interaction, making exploitation trivial for remote attackers over the network.

Blast radius

Successful exploitation could allow full compromise of the device—including unauthorized configuration changes, data exfiltration, or service disruption—with potential cascading impact on downstream network segments relying on the switch.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to firmware version 1.00.74 or later, as explicitly stated in the description to resolve the vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.