Executive brief
A vulnerability in the N3uron Web User Interface, an industrial IoT platform, allows authenticated users to access the password hashes of every other user on the system. Because the software uses a weak and predictable method for protecting these passwords, an attacker can easily crack them to gain full administrative control or move laterally into other connected corporate systems. This could lead to unauthorized access to industrial operations, data theft, or complete service disruption.
Technical details
A privilege escalation vulnerability exists in the N3uron Web User Interface due to excessive data exposure and insecure cryptographic practices. Authenticated users, regardless of privilege level, can access the 'Config - Roles - Users/Groups' endpoint where WebSocket responses disclose the password hashes of all registered users. The application employs a weak client-side hashing scheme using MD5 on a predictable string format ('n3@' + password + '@'). An attacker can capture these hashes and perform efficient offline brute-force attacks to recover plaintext credentials, leading to full account takeover and lateral movement. The issue is addressed in version 1.21.15 and the 1.22.x release branch.
Affected products
- N3uron Web User Interface v1.21.x prior to v1.21.15, all versions prior to v1.21
Timeline
- 2026-01-29: disclosed: Initial CVE disclosure date
- 2026-02-04: other: Vulnerability reported to vendor by a customer
- 2026-02-10: patched: Vendor released version 1.21.15 to address the issue
- 2026-02-26: advisory: Vendor published official security advisory