Paper/Archive/CVE-2026-1341

CVE-2026-1341

Avation Avation Light Engine Pro — Missing Authentication for Critical Function in Avation Light Engine Pro

EPSS 0.5%CVSS 9.3

critical.is priorityof 100

37

CVSS 9.3 (CNA)9.3 / 10 × 3027.9 Not in CISA KEV+300.0 EPSS percentile 45.9.459 × 209.2 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

Avation Light Engine Pro exposes its configuration and control interface without any authentication or access control.

Affected

ProductAffectedFixed inSource

Avation Light Engine ProAll–CNA

Scores by source

icscert (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refcisa.gov/news-events/ics-advisories/icsa-26-034-02 refgithub.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-034-02.json refavation.co.nz/contact-us