CVE-2026-14837
Last modified
CVE-2026-14837 is a high-severity vulnerability rated 8.5/10 on the CVSS scale. Multiple Lenze products are affected by an improper signature verification vulnerability in the SSH enablement mechanism. A low-privileged local attacker can bypass verification of the SSH enable file signature and enable SSH access on the device. EPSS estimates a 0.08% chance of exploitation in the next 30 days.
Description
Multiple Lenze products are affected by an improper signature verification vulnerability in the SSH enablement mechanism. A low-privileged local attacker can bypass verification of the SSH enable file signature and enable SSH access on the device. Successful exploitation may result in unauthorized administrative access and complete system compromise.
Metrics
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| Lenze | c430 | >= 1.0.0, < 1.15.2 |
| Lenze | c520 | >= 1.0.0, < 1.15.2 |
| Lenze | c550 | >= 1.0.0, < 1.15.2 |
| Lenze | i950 GenA | >= 1.0.0, < 1.14.2 |
| Lenze | i950 GenB | >= 2.0.0, < 2.0.3 |
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2026-14837?
How severe is CVE-2026-14837?
How do I fix CVE-2026-14837?
How Strix Helps
- Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-1483An out-of-band SQL injection vulnerability (OOB SQLi) has be…7.5
- CVE-2026-14830The FlxWoo WordPress plugin before 3.1.1 does not verify wit…7.5
- CVE-2026-14831The Easy Booking WordPress plugin before 3.5.0 does not re-e…5.3
- CVE-2026-14833The Lightbox with PhotoSwipe WordPress plugin before 5.9.0 d…6.8
- CVE-2026-14834The Mailgun for WordPress plugin before 2.2.1 does not perfo…6.5
- CVE-2026-14836The Login & Register Forms WordPress plugin before 3.2.5 do…8.1
- CVE-2026-14838Use of GET request method with sensitive query strings vulne…7.4
- CVE-2026-14839The Mapster WP Maps WordPress plugin before 1.24.0 does not …7.5
- CVE-2026-1484A flaw was found in the GLib Base64 encoding routine when pr…4.2
- CVE-2026-14840The YOP Poll WordPress plugin before 7.0.6 does not validate…5.3
- CVE-2026-14841The King Addons for Elementor WordPress plugin before 51.1.…6.1
- CVE-2026-14842The Events Made Easy WordPress plugin before 3.1.2 does not …5.3
Are you affected by CVE-2026-14837?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST