CVE-2026-94493
Gigatech PDV5701 WebSocket Service index.html missing authentication
- Critical 10.0
- A public exploit reference is listed
Description
A vulnerability was detected in Gigatech PDV5701 1.0.31_240305_112640. This issue affects some unknown processing of the file /index.html of the component WebSocket Service. The manipulation results in missing authentication. The attack can be launched remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Key facts
- Published
- 22 Sep 2026
- Last changed
- 24 Sep 2026
- Assigned by
- VulDB
- EPSS
- 0.73% likely to be exploited in the next 30 days, higher than 54.823% of CVEs (scores for 15 Nov 2026)
- SSVC (CISA)
- Exploitation: poc; Automatable: yes; Technical impact: total
Severity scores
Each score is shown as its source gave it. They are not averaged or merged.
- 10.0CVSS 4.0, Criticalfrom the CNA (VulDB)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P - 10.0CVSS 3.1, Criticalfrom the CNA (VulDB)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R - 10.0CVSS 3.0, Criticalfrom the CNA (VulDB)
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R - 10.0CVSS 2.0, Highfrom the CNA (VulDB)
AV:N/AC:L/Au:N/C:C/I:C/A:C/E:POC/RL:ND/RC:UR
Historical context and remediation
This reference retains the original CVE publication date. A recent record update does not mean a new attack occurred.
No separately sourced impact summary is available on this page yet. Consult the description, version data and dated exploitation evidence.
No explicit remediation statement is available on this page yet. Consult the original record and vendor references before choosing a fix.
Version statuses below come from the CNA. An “unaffected” version is not necessarily a currently supported release or proof of a patch date. EPSS is a dated risk estimate, not a count of historical attacks.
Affected products
| Vendor | Product | Versions |
|---|---|---|
| Gigatech | PDV5701 |
|
Timeline
- 21 Sep 2026 Advisory disclosed
- 21 Sep 2026 VulDB entry created
- 21 Sep 2026 VulDB entry last update
- 22 Sep 2026 Published
Weakness
References
- VDB-408193 | Gigatech PDV5701 WebSocket Service index.html missing authentication
- VDB-408193 | CTI Indicators (IOB, IOC, IOA)
- CVE-2026-94493 | CVE Analysis and Report
- Submit #895425 | Gigatech R&D Corporation PDV5701 Config Web Management Firmware for PDV5701 DoorStation SwVersion 1.0.31_240305_112640，HW Version 004.002.001 Missing Authentication
- github.com