HTTP API Authentication Bypass Vulnerability in Socomec DIRIS A-40 Power Monitoring Device

CVE-2026-2491

What is CVE-2026-2491?

The Socomec DIRIS A-40 power monitoring device has a vulnerability in its HTTP API that enables network-adjacent attackers to bypass authentication. This flaw arises from the lack of necessary authentication checks within the web API's implementation, which typically listens on TCP port 80. As a result, unauthorized individuals can access the device's functionalities, potentially leading to security breaches. It is crucial for organizations using these devices to assess their security posture and implement necessary measures to mitigate such risks. For further details, visit the vendor's advisory.

References