Executive brief
The Device Configuration Framework contains a flaw that allows an attacker with viewer-level credentials to bypass authentication controls and gain unauthorized access. An attacker would need valid viewer account credentials to exploit this vulnerability, potentially leading to unauthorized configuration changes or data access on managed devices.
Technical details
The vulnerability is an authentication bypass flaw in the Device Configuration Framework that requires prior authentication with a viewer-privileged service account. The flaw allows an authenticated attacker to circumvent authorization controls after initial authentication. The attack vector is local/adjacent since it requires valid credentials, and the precondition of viewer-level account access limits the attack surface. An attacker can achieve unauthorized access to restricted functionality or configuration data. Patches or workarounds should be available from the vendor.
Affected products
- Device Configuration Framework
Timeline
- 2026-08-11: disclosed