CVE-2026-75108: Next Terminal Missing Per-Asset Authorization on Portal Endpoints
Next Terminal fails to enforce per-asset authorization checks on the portal ping and wake-on-LAN endpoints, allowing any authenticated user to probe and wake assets they are not granted access to. Attackers can call these endpoints with arbitrary asset identifiers to retrieve asset information including display names, reachability status, connection timing, and network addresses, or trigger wake-on-LAN packets on unauthorized assets.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-75108?
The severity of CVE-2026-75108 is classified as medium with a score of 5.4.
What vulnerabilities does CVE-2026-75108 expose?
CVE-2026-75108 exposes a lack of per-asset authorization checks on portal ping and wake-on-LAN endpoints.
How can I mitigate CVE-2026-75108?
Mitigation for CVE-2026-75108 involves implementing strict per-asset authorization checks within the Next Terminal application.
Who is impacted by CVE-2026-75108?
Any authenticated user of Next Terminal can potentially access and wake assets they are not authorized to control due to CVE-2026-75108.
What are the potential consequences of CVE-2026-75108?
The potential consequences of CVE-2026-75108 include unauthorized probing and waking of assets, which could lead to information leakage.