| عنوان | Akubela (by Akuvox) HyPanel PS51 (Smart Home Control Panel / Intercom Gateway) 51.130.40.26 Authentication Bypass Using Alternate Channel |
|---|
| الوصف | We have found an authentication bypass and logic flaw exists in the akubela HyPanel (Model PS51, Software Version x.x.x.x) web interface when default credentials remain unchanged.
By analyzing the application's client-side JavaScript files, an engineering mode parameter (?engrmode=admin) was identified. Under normal circumstances, attempting to access administrative features with default credentials triggers a mandatory password-change enforcement prompt. However, if the client-side cache or local browser storage is cleared prior to access, the application fails to properly enforce this mandatory state check.
By appending ?engrmode=admin (e.g., https://<ip>/login?engrmode=admin) after clearing the browser cache, an attacker can bypass both the standard login mechanism and the forced password-change prompt, gaining direct unauthorized access to the administrative dashboard without satisfying security initialization requirements.
Impact: This grants an attacker full administrative control of the panel. From the dashboard, an attacker can unlock and open connected doors, control lighting, modify climate/HVAC settings, and alter other home and building automation functions managed by the device. Because the HyPanel governs physical access and connected systems, this bypass has direct physical-security and safety consequences, not just data exposure.
We are happy to provide a proof-of-concept video or any further detail you need to reproduce and verify this, and we would appreciate acknowledgment once it is resolved. |
|---|
| المصدر | ⚠️ https://github.com/wisklr/Authentication-Bypass-Vulnerability-in-akubela-HyPanel-PS51.git |
|---|
| المستخدم | Wisklr (UID 101895) |
|---|
| ارسال | 04/10/2026 02:59 PM (24 أيام منذ) |
|---|
| الاعتدال | 26/10/2026 09:12 AM (22 days later) |
|---|
| الحالة | تمت الموافقة |
|---|
| إدخال VulDB | 426335 [Akuvox Akubela HyPanel PS51 51.130.40.26 /login engrmode توثيق ضعيف] |
|---|
| النقاط | 20 |
|---|