Vendors / Innomic Records 7 All Threatist records
Exploited (KEV) 0 None in CISA KEV
CVSS critical 1
CVSS high 4
Exploited now Innomic records in CISA KEV No Innomic vulnerabilities are listed in CISA KEV.
Priority MEDIUM 50
An unauthenticated remote attacker can gain full access on the affected devices as they are shipped without a password by default and setting one is not enforced.
CVSS 3.1 CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00585 · Published 2026-02-02 · Fixed in 2.1.1340, 2.1.1866 +2 CWE-306
Priority MEDIUM 40
An unauthenticated remote attacker is able to use an existing session id of a logged in user and gain full access to the device if configuration via ethernet is enabled.
CVSS 3.1 HIGH 8.8· Network · No auth · User interaction · EPSS 0.00257 · Published 2026-02-02 · Fixed in 2.1.1866, 2.1.1340 +2 CWE-346
Priority LOW 39
An unauthenticated remote attacker could potentially disrupt operations by switching between multiple configuration presets via Modbus (TCP).
CVSS 3.1 HIGH 7.5· Network · No auth · No interaction · EPSS 0.00499 · Published 2026-02-02 · Fixed in 2.1.1340, 2.1.1866 +2 CWE-306
Priority LOW 39
An unauthenticated remote attacker could potentially disrupt operations by switching between multiple configuration presets via HTTP.
CVSS 3.1 HIGH 7.5· Network · No auth · No interaction · EPSS 0.0049 · Published 2026-02-02 · Fixed in 2.1.1340, 2.1.1866 +2 CWE-306
Priority LOW 33
A local attacker could cause a full device reset by resetting the device passwords using an invalid reset file via USB.
CVSS 3.1 HIGH 7.7· Local · No auth · No interaction · EPSS 0.00154 · Published 2026-02-02 · Fixed in 5.1.2730, 4.0.1931 CWE-1288
Priority LOW 28
A unauthenticated adjacent attacker could potentially disrupt operations by switching between multiple configuration presets via CAN.
CVSS 3.1 MEDIUM 6.5· Adjacent network · No auth · No interaction · EPSS 0.0022 · Published 2026-02-02 · Fixed in 2.1.1340, 2.1.1866 +2 CWE-306
Priority LOW 28
An unauthenticated adjacent attacker could potentially disrupt operations by switching between multiple configuration presets via Modbus (RS485).
CVSS 3.1 MEDIUM 6.5· Adjacent network · No auth · No interaction · EPSS 0.0022 · Published 2026-02-02 · Fixed in 2.1.1340, 2.1.1866 +2 CWE-306
Open these records in search → All records by CVSS severity
1 4 2 0 0
THREATIST.IORead the docs