| Title | Akubela (by Akuvox) HyPanel PS51 (Smart Home Control Panel / Intercom Gateway) 51.130.40.26 Authentication Bypass Using Alternate Channel |
|---|
| Description | We have found an authentication bypass and logic flaw exists in the akubela HyPanel (Model PS51, Software Version x.x.x.x) web interface when default credentials remain unchanged.
By analyzing the application's client-side JavaScript files, an engineering mode parameter (?engrmode=admin) was identified. Under normal circumstances, attempting to access administrative features with default credentials triggers a mandatory password-change enforcement prompt. However, if the client-side cache or local browser storage is cleared prior to access, the application fails to properly enforce this mandatory state check.
By appending ?engrmode=admin (e.g., https://<ip>/login?engrmode=admin) after clearing the browser cache, an attacker can bypass both the standard login mechanism and the forced password-change prompt, gaining direct unauthorized access to the administrative dashboard without satisfying security initialization requirements.
Impact: This grants an attacker full administrative control of the panel. From the dashboard, an attacker can unlock and open connected doors, control lighting, modify climate/HVAC settings, and alter other home and building automation functions managed by the device. Because the HyPanel governs physical access and connected systems, this bypass has direct physical-security and safety consequences, not just data exposure.
We are happy to provide a proof-of-concept video or any further detail you need to reproduce and verify this, and we would appreciate acknowledgment once it is resolved. |
|---|
| Source | ⚠️ https://github.com/wisklr/Authentication-Bypass-Vulnerability-in-akubela-HyPanel-PS51.git |
|---|
| User | Wisklr (UID 101895) |
|---|
| Submission | 10/04/2026 14:59 (22 days ago) |
|---|
| Moderation | 10/26/2026 09:12 (22 days later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 426335 [Akuvox Akubela HyPanel PS51 51.130.40.26 /login engrmode improper authentication] |
|---|
| Points | 20 |
|---|