Vulnerability · Published May 9, 2026 · Assigned by VulDB

CVE-2026-8185UGREEN CM933 Administrative missing authentication

Medium 6.3

In plain English

A medium-severity missing authentication in CM933 from UGREEN. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 25% of all known vulnerabilities).

Severity (CVSS 3.1)6.3Medium

Exploit odds (30 days)0.3%top 74.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A security vulnerability has been detected in UGREEN CM933 1.1.59.4319. The impacted element is an unknown function of the component Administrative Interface. Such manipulation leads to missing authentication. The attack requires being on the local network. You should upgrade the affected component. The vendor replied: "We have successfully confirmed and reproduced the issue. We take this matter very seriously and have incorporated the fix into our development schedule. The issue is scheduled to be resolved in the release version coming in late April."

Affected products (as reported)

Vendor	Product	Versions
UGREEN	CM933	1.1.59.4319

Weakness: CWE-306, CWE-287 · Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C

References

VDB-362337 | UGREEN CM933 Administrative missing authentication vdb-entry
VDB-362337 | CTI Indicators (IOB, IOC) signature, permissions-required
Submit #793588 | UGREEN CM933 Managed Network Switch 1.1.59.4319 CWE-306: Missing Authentication for Critical Function third-party-advisory