CVE-2026-126759: H3C ICG2000 Unified Communication Gateway Web Management check.j missing authentication
A flaw has been found in H3C ICG2000 Unified Communication Gateway 2023. This issue affects some unknown processing of the file /wnm/check.j of the component Web Management Module. Executing a manipulation can lead to missing authentication. The attack may be performed from remote. The exploit has been published and may be used. The researcher claims that the vendor has acknowledged receipt of the vulnerability report. No further response has been received.
Event History
Frequently Asked Questions
Who is exposed to this issue?
H3C ICG2000 Unified Communication Gateway deployments running the affected 2023 product version may be exposed if their Web Management Module is reachable remotely. The vulnerability is associated with the /wnm/check.j endpoint.
Does exploitation require authentication or user interaction?
No authentication or user interaction is required according to the reported CVSS vector. The attack can be performed remotely with low attack complexity.
Is public exploitation information available?
Yes. An exploit has been published and may be used, increasing the likelihood of attempted exploitation.
Is a vendor fix available?
The available information states that the vendor acknowledged receiving the report, but no further response has been received. It does not identify a patch or fixed version.
What can be done if patching is not available?
The provided information does not document a vendor workaround. Restricting remote access to the Web Management Module would reduce exposure where operationally possible.