CVE-2026-104935 in Connect Secure
Summary
by MITRE • 10/13/2026
Authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arbitrary commands. This does not impact ICS version 22.7R2.14 or prior.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/13/2026
The vulnerability identified as an authentication bypass via spoofing within Industrial Control Systems (ICS) software versions preceding 25.1.3.0 represents a critical security flaw that fundamentally undermines the integrity of access control mechanisms. This specific defect allows remote, unauthenticated attackers to execute arbitrary commands on affected systems by exploiting weaknesses in how identity verification is performed during communication sessions. The core technical issue lies in the system's failure to adequately validate the authenticity or origin of incoming authentication requests, enabling an adversary to spoof legitimate credentials or session tokens. By manipulating these inputs, the attacker can trick the ICS software into granting elevated privileges without requiring valid user credentials, effectively bypassing the intended security perimeter. This type of flaw is characteristic of improper input validation and insufficient verification of authenticator elements, which are commonly categorized under CWE-287 Improper Authentication or CWE-306 Missing Authentication for Critical Function depending on the specific implementation details of the spoofing mechanism.
The operational impact of this vulnerability is severe due to the nature of industrial control environments where availability and integrity are paramount. An unauthenticated attacker who successfully exploits this flaw gains the ability to execute arbitrary commands with the privileges of the compromised service or application. In an ICS context, command execution can lead to direct manipulation of physical processes, such as adjusting setpoints on programmable logic controllers (PLCs), stopping production lines, or altering safety parameters. This capability poses a significant risk to operational continuity and physical safety, potentially causing equipment damage, environmental hazards, or harm to personnel if the executed commands interfere with critical infrastructure operations. The ability to act without authentication also facilitates lateral movement within the network, as the attacker can use the compromised node as a foothold to probe for additional vulnerabilities in connected systems, thereby expanding their scope of control across the industrial network topology.
It is important to note that this vulnerability does not affect ICS version 22.7R2.14 or any prior releases, indicating that the flaw was introduced in subsequent updates and subsequently addressed in later patches. This distinction highlights the importance of maintaining accurate inventory records of software versions across all operational technology assets. Organizations relying on older, stable builds may be inadvertently protected from this specific threat vector if they have not upgraded to vulnerable intermediate versions. However, for those running affected pre-25.1.3.0 releases, immediate remediation is required. The recommended mitigation strategy involves upgrading the ICS software to version 25.1.3.0 or later, where the authentication logic has been corrected to properly validate spoofed inputs and enforce strict identity verification protocols.
In addition to patching, organizations should implement compensating controls to reduce exposure while updates are being deployed. Network segmentation strategies should be reviewed to ensure that ICS components are isolated from untrusted networks such as corporate IT domains or the public internet. Access control lists (ACLs) on firewalls and routers should restrict inbound traffic to only necessary ports and source IP addresses, minimizing the attack surface available for remote exploitation. Furthermore, monitoring solutions should be configured to detect anomalous authentication attempts or unexpected command executions originating from untrusted sources. Aligning these defenses with MITRE ATT&CK techniques such as T1078 Valid Accounts or T1190 Exploit Public-Facing Application can help in identifying similar attack patterns and improving overall detection capabilities for future incidents involving authentication bypasses in critical infrastructure environments.