CVE-2026-52622 in WES Emergency Broadcast Terminal
Summary
by MITRE • 09/25/2026
An issue in Wellav Technologies Co., Ltd Wellav WES Emergency Broadcast Terminal WES100, WES270, WES280, and WES290 before 08-08-2023 allows a remote attacker to obtain sensitive information via the global API request wrapper function
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/25/2026
The vulnerability identified in Wellav Technologies Co., Ltd. emergency broadcast terminals, specifically models WES100, WES270, WES280, and WES290 prior to the firmware update released on August 8, 2023, represents a critical information disclosure flaw rooted in improper access control mechanisms within the device's web interface. This security defect is primarily associated with the global API request wrapper function, which serves as an intermediary layer for processing incoming HTTP requests destined for various administrative and operational endpoints. The fundamental technical flaw lies in the insufficient validation of authentication tokens or session states before executing sensitive operations through this wrapper. Consequently, the system fails to properly enforce access control policies, allowing unauthenticated actors or those with lower privilege levels to bypass intended security restrictions and interact directly with internal application programming interfaces that were designed for authorized administrators only.
From a technical perspective, the global API request wrapper is typically implemented to standardize how requests are parsed, authenticated, and routed within embedded Linux-based systems common in IoT devices like emergency broadcast terminals. In this specific instance, the implementation likely lacks rigorous checks on the source of the request or fails to verify that the caller possesses valid administrative credentials before processing commands related to system configuration, user management, or data retrieval. This oversight creates a path for remote attackers to exploit the lack of proper authorization logic. By crafting malicious HTTP requests directed at specific API endpoints exposed through this wrapper, an attacker can trigger actions or retrieve responses intended only for privileged users. The vulnerability aligns with CWE-284 Improper Access Control and CWE-798 Use of Hard-coded Credentials if authentication bypass relies on predictable token structures, though the primary classification remains centered around broken access control mechanisms that allow unauthorized data exfiltration.
The operational impact of this vulnerability is severe due to the nature of emergency broadcast terminals, which are critical infrastructure components responsible for disseminating public safety alerts and system status information. An attacker leveraging this flaw can obtain sensitive information such as administrative passwords, network configuration details including IP addresses and gateway settings, device serial numbers, and potentially logs containing user activity or connected client data. This exposure compromises the confidentiality of the entire broadcast network segment to which these terminals are attached. Furthermore, access to internal API endpoints may provide insights into system architecture that could facilitate further attacks, such as privilege escalation or denial-of-service conditions by manipulating critical service parameters. The ability to extract this information remotely without prior authentication significantly lowers the barrier for entry for malicious actors targeting public safety infrastructure.
Mitigation strategies must focus on immediate patching and rigorous access control enforcement. Wellav Technologies released a firmware update after August 8, 2023, which addresses these flaws by implementing stricter validation within the global API request wrapper function. Administrators should immediately upgrade all affected WES100, WES270, WES280, and WES290 units to the patched version to eliminate this attack vector. In addition to patching, organizations deploying these devices in production environments should enforce network segmentation to isolate emergency broadcast terminals from general corporate or public networks, ensuring that management interfaces are only accessible via secure, authenticated channels such as VPNs with multi-factor authentication. Regular security audits and penetration testing focused on API endpoints can help identify similar misconfigurations before they are exploited. Adhering to industry standards like the OWASP IoT Top 10, particularly regarding broken access control and insecure default configurations, is essential for maintaining the integrity of critical communication systems.