Skip to content
Fencer Vulns
high 8.8

CVE-2026-21411 json

Authentication bypass issue exists in OpenBlocks series versions prior to FW5.0.8, which may allow an attacker to bypass administrator auth…

published 2026-01-06 10 mo ago modified 2026-06-17 4 mo ago also EUVD-2026-1070

cvss
8.8
version 3.0, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.4%
EPSS 0.4% chance of exploitation in 30 days, percentile 31%
public exploits
0
none known

Summary

Authentication bypass issue exists in OpenBlocks series versions prior to FW5.0.8, which may allow an attacker to bypass administrator authentication and change the password.

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
10 mo ago

Exploit prediction

0.37% chance of exploitation in the next 30 days, higher than 31% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.0 8.8 CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA 4.0 8.7 CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CNA 4.0 8.7 CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affected products

  • Plat'Home Co.,Ltd. OpenBlocks IoT DX1 (FW5.0.x)
  • Plat'Home Co.,Ltd. OpenBlocks IoT EX/BX models (FW5.0.x)
  • Plat'Home Co.,Ltd. OpenBlocks IX9 models with FW (FW5.0.x)
  • Plat'Home Co.,Ltd. OpenBlocks IoT VX2 (FW5.0.x)
  • Plat'Home Co.,Ltd. OpenBlocks IDM RX1 (FW5.0.x)
  • Plat'Home Co.,Ltd. OpenBlocks IoT FX1 (FW5.0.x)

Classification

Weakness
  • CWE-288 Authentication Bypass Using an Alternate Path or Channel

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.