CVE-2026-102155: Security Advisory 0190

Published Oct 6, 2026

Updated

An XML External Entity (XXE) injection vulnerability in the WiFi-server Spectralight application allows any authenticated user to send malicious requests, leading to arbitrary local file disclosure and partial denial of service.

Affected Software

1 affected component

Spectralight WiFi-server

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade WiFi-server Spectralight application to a version that resolves this vulnerability.
Fixed in 2026.2.1Patch Security Advisory 0190

Event History

Oct 6, 2026

CVE Published

via MITRE·07:39 PM

Data Sourced

via MITRE·07:39 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·08:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What level of access does an attacker need?

An attacker must be authenticated to the Spectralight WiFi-server application. The CVSS vector indicates the attack can be performed over the network with low attack complexity and requires no user interaction.

What could exploitation allow?

Exploitation can disclose arbitrary local files and cause a partial denial of service. The listed impact affects confidentiality and availability; no integrity impact is specified.

CVE-2026-102155: Security Advisory 0190

Affected Software

Remediation

Event History

Frequently Asked Questions

What level of access does an attacker need?

What could exploitation allow?

Company

Resources

Contact

Frequently Asked Questions

What level of access does an attacker need?

What could exploitation allow?