CVE-2026-70381: Unauthorized Access to Internal Web Resources
An access-control vulnerability has been identified in the web server configuration. Some resources intended for on-device use only could be accessed remotely by an unauthenticated attacker with network access to the web interface. The accessible resources do not expose credentials or provide administrative functionality, but may include non-public device content, such as screen-saver content or assets used by the web interface.
Event History
Frequently Asked Questions
Who can exploit this issue?
An unauthenticated attacker with network access to the device's web interface could access certain resources intended only for on-device use. No credentials or user interaction are required.
What information or functions are exposed?
The affected resources may contain non-public device content, including screen-saver content or assets used by the web interface. The available information does not indicate exposure of credentials or administrative functionality.