CVE-2026-77974

CVE-2026-77974 is a missing-authentication flaw (CWE-306) in a firmware update mechanism, assigned by CISA ICS-CERT; the source data does not name the affected vendor or product. An attacker positioned on an adjacent network who spoofs the device to the application and obtains a single user confirmation may be able to cause the application to transmit firmware over an unauthenticated and unsigned update channel, potentially delivering attacker-controlled or unverified firmware to the device. The CVSS 4.0 score of 8.5 (High) reflects high impact to the confidentiality, integrity, and availability of the vulnerable system, with no privileges required and only one user action needed. Exposure cannot be quantified from the available data because no product, version range, or install-base figures are provided, though the ICS-CERT assignment suggests an industrial or IoT-style device deployment. There is no evidence of exploitation in the wild and no public proof-of-concept is known.

What to do: Check the CISA ICS-CERT advisory for CVE-2026-77974 to confirm the affected product and version range, then apply the vendor's patched application or firmware as soon as it is published. Until patched, restrict adjacent-network access to the device (e.g., pairing range or local network segment), treat any unsolicited firmware-update prompt with suspicion, and verify that the update channel enforces signed and authenticated firmware.