Paper/Archive/CVE-2026-2417

CVE-2026-2417

Pharos Controls Mosaic Show Controller — Missing Authentication for Critical Function in Pharos Controls Mosaic Show Controller

EPSS 0.6%CVSS 9.3

critical.is priorityof 100

CVSS 9.3 (CNA)9.3 / 10 × 3027.9 Not in CISA KEV+300.0 EPSS percentile 48.5.485 × 209.7 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

A Missing Authentication for Critical Function vulnerability in Pharos Controls Mosaic Show Controller firmware version 2.15.3 could allow an unauthenticated attacker to bypass authentication and execute arbitrary commands with root privileges.

Affected

ProductAffectedFixed inSource

Mosaic Show Controller2.15.3–CNA

Scores by source

icscert (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refcisa.gov/news-events/ics-advisories/icsa-26-083-01