Critical Authentication Bypass in Avation Light Engine Pro Allows Full Device Takeover

#cybersecurity #infosec

Summary

Avation Light Engine Pro contains a critical vulnerability (CVE-2026-1341) that allows unauthenticated remote attackers to take full control of the device due to a complete lack of authentication.

Take Action:

Isolate your Avation Light Engine Pro from the internet and make them accessible only from trusted networks. There is no patch, and the vendor is unresponsive. Use a VPN and firewalls to ensure only authorized internal staff can reach the control interface, and start planning for a replacement.

Read the full article on BeyondMachines

This article was originally published on BeyondMachines