Paper/Archive/CVE-2026-1633

CVE-2026-1633

Synectix LAN 232 TRIO — Synectix LAN 232 TRIO Missing Authentication for Critical Function

CVSS 10.0 (CNA)10.0 / 10 × 3030.0 Not in CISA KEV+300.0 EPSS percentile 48.6.486 × 209.7 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

The Synectix LAN 232 TRIO 3-Port serial to ethernet adapter exposes its web management interface without requiring authentication, allowing unauthenticated users to modify critical device settings or factory reset the device.

Affected

ProductAffectedFixed inSource

LAN 232 TRIOAll versions–CNA

Scores by source

icscert (CNA)10.0CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

icscert (CNA)10.0CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refcisa.gov/news-events/ics-advisories/icsa-26-034-04 refgithub.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-034-04.json