CVE-2026-75108 in Next Terminal
Summary
by MITRE • 08/17/2026
Next Terminal fails to enforce per-asset authorization checks on the portal ping and wake-on-LAN endpoints, allowing any authenticated user to probe and wake assets they are not granted access to. Attackers can call these endpoints with arbitrary asset identifiers to retrieve asset information including display names, reachability status, connection timing, and network addresses, or trigger wake-on-LAN packets on unauthorized assets.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/17/2026
The vulnerability in Next Terminal represents a critical failure in the implementation of access control mechanisms within its administrative interface, specifically affecting the portal ping and Wake-On-LAN endpoints. This flaw stems from an insufficient verification process where the application fails to validate whether the authenticated user initiating the request possesses the necessary permissions for the specific target asset identified by the provided identifier. In secure systems, authorization checks must be performed at every step of a privileged operation, ensuring that the context of the current session is strictly mapped against the resources being accessed. Here, the server processes requests based solely on the presence of valid authentication credentials rather than verifying granular permissions associated with each asset ID included in the request payload. This architectural oversight allows any authenticated user to bypass intended isolation boundaries between different organizational units or security zones managed by the terminal management platform.
From a technical perspective, this is classified as an Insecure Direct Object Reference vulnerability, which corresponds to CWE-639 in the Common Weakness Enumeration standard. The core issue lies in the server-side logic that accepts arbitrary asset identifiers without cross-referencing them against the user's assigned role or group memberships. When a request is made to these endpoints, the application retrieves and processes data for the specified asset regardless of whether the requester has been granted explicit access rights to it. This lack of object-level authorization enables an attacker who has obtained valid credentials through phishing, credential stuffing, or other means to enumerate internal infrastructure details without needing elevated privileges. The vulnerability effectively turns authenticated accounts into tools for reconnaissance against assets they are not authorized to manage or view.
The operational impact of this flaw is significant as it facilitates unauthorized information disclosure and potential disruption of services via Wake-On-LAN triggers. By exploiting the ping endpoint, an attacker can probe internal network segments to gather sensitive intelligence about connected devices. This includes retrieving display names which may reveal hardware models or software configurations, reachability status indicating if a machine is online and vulnerable to active attacks, connection timing data that might expose operational hours or maintenance windows, and precise network addresses such as IP and MAC addresses. Such information is invaluable for planning further lateral movement within the network. Furthermore, the ability to trigger Wake-On-LAN packets on unauthorized assets allows an attacker to disrupt service availability by waking dormant machines, potentially causing noise in monitoring systems or consuming resources if those devices are not designed to handle unexpected power states.
This vulnerability aligns with several tactics and techniques defined in the MITRE ATT&CK framework. The ability to probe asset reachability and retrieve network addresses corresponds to Network Service Discovery (T1046) and potentially System Information Discovery depending on the depth of data returned. If Wake-On-LAN is used to disrupt operations, it falls under Impact or Disruption techniques like Denial of Service via resource exhaustion or service interruption. The exploitation path also relates to Privilege Escalation if an attacker uses this information to identify high-value targets for subsequent attacks that they might be able to compromise due to weaker security postures on those specific assets compared to the terminal management platform itself.
Mitigation strategies must focus on implementing robust authorization checks at the application layer immediately upon receipt of any request targeting a managed asset. Developers should enforce strict access control lists or role-based access controls for every endpoint, ensuring that the user's permissions are validated against the target resource ID before processing logic is executed. Input validation alone is insufficient; server-side permission verification is mandatory. Additionally, implementing rate limiting on these endpoints can help mitigate automated scanning efforts even if authorization checks were temporarily bypassed in other scenarios. Logging and monitoring should be enhanced to detect unusual patterns of asset probing by users who do not typically interact with such a wide variety of assets, providing an additional layer of defense through anomaly detection.