Description

Next Terminal fails to enforce per-asset authorization checks on the portal ping and wake-on-LAN endpoints, allowing any authenticated user to probe and wake assets they are not granted access to. Attackers can call these endpoints with arbitrary asset identifiers to retrieve asset information including display names, reachability status, connection timing, and network addresses, or trigger wake-on-LAN packets on unauthorized assets.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-08-17T21:16:49.757Z",
  "pubdate": "2026-08-17T21:16:49.757Z",
  "executiveSummary": "Next Terminal suffers from an authorization bypass vulnerability affecting the portal ping and wake-on-LAN endpoints. This security flaw stems from a failure to enforce adequate per-asset authorization checks, allowing any authenticated user to interact with assets outside their assigned permissions. The impact of this vulnerability includes unauthorized information disclosure and the unauthorized triggering of network actions on remote systems. Specifically, attackers can probe arbitrary asset identifiers to harvest sensitive operational intelligence, such as display names, reachability status, connection timing, and network addresses. Furthermore, malicious actors can invoke the wake-on-LAN functionality to dispatch magic packets to unauthorized hardware targets across the network. The affected product is Next Terminal. The risk implications involve a compromise of internal network reconnaissance visibility and unauthorized physical state changes of infrastructure components. Exploitation requirements are minimal, necessitating only valid authentication to the portal interface, after which an attacker possesses the capability to systematically enumerate and manipulate assets beyond their authorized scope.",
  "technicalDetails": "The vulnerability resides within the authorization logic governing the portal ping and wake-on-LAN endpoints of Next Terminal. The root cause of the issue is the absence of granular, per-asset access control validation prior to processing requests destined for specific asset identifiers. When an authenticated user submits a request to the vulnerable endpoints, the application processes the provided arbitrary asset identifiers without verifying whether the requesting user possesses explicit access rights to the targeted resources. The vulnerable components are the backend routing and controller logic handling portal ping and wake-on-LAN operations. Authentication requirements are restricted to standard user authentication, meaning any baseline user account possesses sufficient privileges to exploit the flaw. Privilege requirements are effectively non-existent beyond the initial authentication boundary, as role-based access control or ownership validation is bypassed entirely during the endpoint evaluation. Network exposure encompasses the standard web interface of Next Terminal where authenticated users interact with the portal. The attack flow proceeds as follows: First, an authenticated attacker identifies the target endpoints responsible for portal ping and wake-on-LAN functionality. Second, the attacker crafts malicious HTTP requests containing arbitrary or sequentially guessed asset identifiers. Third, the Next Terminal backend accepts the request and queries the underlying systems or dispatches network packets without validating the caller's authorization context against the target asset. Finally, the endpoint returns detailed asset information, including display names, reachability status, connection timing, and network addresses, or successfully transmits wake-on-LAN packets to the specified target. The payload behavior involves parameter manipulation where identifiers are injected into the request body or URI parameters to force the application to act on unauthorized resources. The post-exploitation impact includes unauthorized internal reconnaissance, exposure of sensitive network topology data, and the potential disruption or unauthorized power state manipulation of enterprise assets via rogue wake-on-LAN commands."
}