Missing authentication in Pantum BP5100DW web interface
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-287.
Summary
Pantum BP5100DW 3.A.4.7 has a missing authentication flaw in its web interface. The file /shtml/omDB.shtml can be reached without any authentication check (CWE-306). A remote attacker can use this without credentials. The vendor was contacted before disclosure but did not respond.
Written with Claude Haiku 5.5 from the sources below · 2026-11-09
Description from the CNA
A security vulnerability has been detected in Pantum BP5100DW 3.A.4.7. The impacted element is an unknown function of the file /shtml/omDB.shtml of the component Web Interface. The manipulation leads to missing authentication. The attack may be initiated remotely. The vendor was contacted early about this disclosure but did not respond in any way.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Pantum | BP5100DW | 3.A.4.7 | — | No fix listed | CNA |
- BP5100DW VendorPantum Affected 3.A.4.7 Fixed in — No fix listed CNA
CPE names CNA · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:pantum:bp5100dw:*:*:*:*:*:*:*:* | — | — | — |
- cpe:2.3:a:pantum:bp5100dw:*:*:*:*:*:*:*:* Versions — — ·—
Remediation
The sources list no fixed version for Pantum BP5100DW.
Written with Claude Haiku 5.5 from the sources below · 2026-11-09
Timeline
- 2026-11-09 Threatist record created from CVE-2026-124578
References
—
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences