Executive brief
cu silicon is a Python application with a web-based edit endpoint. A missing authentication vulnerability in the create_app function allows remote attackers to manipulate the endpoint without providing valid credentials, potentially leading to unauthorized modification of application configuration or data.
Technical details
This is an authentication bypass vulnerability in cu silicon's edit endpoint (create_app function in views.py). The vulnerability exists because the endpoint fails to perform proper authentication validation before processing requests, allowing unauthenticated remote attackers to interact with the functionality. No authentication or special preconditions are required to exploit this flaw. An attacker can remotely invoke the create_app endpoint to perform unauthorized operations. A public exploit is available. The vendor has not responded to early disclosure notifications.
Affected products
- cu silicon up to 0.1.5
Timeline
- 2026-08-31: disclosed
- other: Public exploit available