Description

Missing authentication for critical function vulnerability exists in Remote I/O Coupler Unit (Server Type) CPSN-MCB271-*. An attacker may execute a REST API without authentication, which could allow the attacker to retrieve I/O values and/or control the output.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-09-14T07:17:20.230Z",
  "pubdate": "2026-09-14T07:17:20.230Z",
  "executiveSummary": "The Remote I/O Coupler Unit (Server Type) CPSN-MCB271-* is susceptible to an authentication bypass vulnerability stemming from a missing authentication check on critical functions exposed via the REST API.\nThis vulnerability allows unauthenticated, remote attackers to interact with the device's management interface without providing valid credentials.\nThe primary impact of this flaw includes unauthorized retrieval of sensitive I/O sensor data and the ability to manipulate device outputs, potentially leading to operational disruption or physical process interference.\nThe flaw affects the entire CPSN-MCB271-* product line.\nThe risk is critical due to the lack of exploitation complexity; an attacker only requires network reachability to the device's API endpoint to execute unauthorized commands.\nThis vulnerability poses a significant security risk for industrial control environments where integrity and confidentiality of I/O operations are paramount.",
  "technicalDetails": "The vulnerability resides within the REST API implementation of the CPSN-MCB271-* Remote I/O Coupler Unit. The device exposes a series of API endpoints designed for monitoring and configuration purposes; however, these endpoints fail to implement mandatory authentication mechanisms before processing incoming requests.\nThe root cause is an insecure API design where critical functions are accessible to any entity capable of establishing a network connection to the device's server-side listener. The application lacks session validation or credential verification routines for API calls, treating all incoming REST requests as trusted commands.\nThe exploitation flow is straightforward: an attacker identifies the network address of the vulnerable unit and crafts malicious HTTP requests targeting the REST API endpoints. Because the backend service does not verify the identity of the requester, the API handler executes the requested operation—such as reading current I/O register states or writing values to output pins—with the privileges of the device's service account.\nThe attack vector is exclusively network-based. By utilizing standard HTTP methods (e.g., GET for data extraction or POST/PUT for output manipulation), an adversary can gain full control over the I/O unit's operational states. The lack of an authentication layer means there are no privilege requirements, allowing an unauthenticated remote user to exert complete control over the hardware.\nPost-exploitation, an attacker can perform reconnaissance to understand the attached I/O mappings, potentially leading to unauthorized manipulation of industrial processes. The capability to control output signals introduces the potential for physical harm or equipment damage, as the attacker can bypass safety logic typically enforced at the application or PLC level by interacting directly with the I/O coupler firmware.\nThe vulnerability affects all firmware iterations of the CPSN-MCB271-* series. As the flaw is inherent to the REST API server-side architecture, the risk persists across all network-exposed instances of the device."
}