Vulnerability · Published Jan 6, 2026 · Assigned by jpcert
CVE-2026-21411
High 8.8
In plain English
A high-severity authentication bypass in OpenBlocks IDM RX1 (FW5.0.x) from Plat'Home Co.,Ltd.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 31% of all known vulnerabilities).
Severity (CVSS 3.0)8.8High
Exploit odds (30 days)0.4%top 68.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Authentication bypass issue exists in OpenBlocks series versions prior to FW5.0.8, which may allow an attacker to bypass administrator authentication and change the password.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Plat'Home Co.,Ltd. | OpenBlocks IoT DX1 (FW5.0.x) | all versions prior to FW5.0.8 |
| Plat'Home Co.,Ltd. | OpenBlocks IoT EX/BX models (FW5.0.x) | all versions prior to FW5.0.8 |
| Plat'Home Co.,Ltd. | OpenBlocks IX9 models with FW (FW5.0.x) | all versions prior to FW5.0.8 |
| Plat'Home Co.,Ltd. | OpenBlocks IoT VX2 (FW5.0.x) | all versions prior to FW5.0.8 |
| Plat'Home Co.,Ltd. | OpenBlocks IDM RX1 (FW5.0.x) | all versions prior to FW5.0.8 |
| Plat'Home Co.,Ltd. | OpenBlocks IoT FX1 (FW5.0.x) | all versions prior to FW5.0.8 |
Weakness: CWE-288 · Vector: CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H