VAPTCoordinated vulnerability disclosure platformResearcher recognition, vendor coordination, and CVE support
LoginRequest CVE
HIGH Vulnerability

CVE-2026-11801

Router management interface exposed to the public internet

Multiple customer edge deployments exposed administrative interfaces without enforced MFA, allowing attackers to pivot into internal management planes.

CVECVE-2026-11801
TitleRouter management interface exposed to the public internet
Case NumberVAPT-2026-00002
Status
Published
Credits
  • R. Navarro (finder)
Affected products
ProductAffectedUnaffectedUnknown
Sentinel Research Collective VAPT Edge Controller 3.x and downstream deployments with legacy admin exposureVAPT Edge Controller 3.0.0 through 3.4.7VAPT Edge Controller 3.4.8 and later with restricted management exposureUnknown
CVSS
Base score8.2 - HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
Attack VectorNETWORK
Attack ComplexityLOW
Privileges RequiredLOW
User InteractionNONE
ScopeUNCHANGED
Confidentiality ImpactHIGH
Integrity ImpactHIGH
Availability ImpactLOW
References
Problem type(s)
CWE / Problem TypeMITRE TacticsMITRE Techniques
    		Not mappedNot mapped
    Date publishedFeb 18, 2026
    Last modifiedApr 10, 2026, 13:43 UTC

    Description

    The affected deployments exposed an inherited administrative listener to the public internet and did not consistently enforce MFA or origin restrictions on management requests. This lowered the barrier for credential attacks and privileged reconfiguration.

    Known Detection Rules

    No authenticated YARA, Sigma, or KQL detection content is attached to this CVE.

    References

    JSON Version