CVE-2026-1840: Hubbell Aclara Metrum Cellular Web Interface Missing Authentication Vulnerability

Vulnerability Overview Vulnerability Name: Missing Critical Function Authentication CVE ID: CVE-2026-1840 CVSS Score: 7.5 (High) Description: Aclara Metrum Cellular Web Interface suffers from an unauthorized access vulnerability due to the lack of authentication. Affected Scope Affected Product: CSAPID-0001 Deployment Region: United States Industry Sector: Energy, Critical Infrastructure Remediation Plan Recommended Measures: - Minimize network exposure to ensure all control system devices/systems are not accessible over the network. - Place control system networks and remote devices behind firewalls and isolate them from business networks. - If remote access is required, use more secure access methods such as Virtual Private Networks (VPN), and identify and log all remote access. - Conduct appropriate impact analysis and risk assessment before deploying defensive controls. - Implement recommended cybersecurity policies to proactively defend Industrial Control Systems (ICS). - Monitor for suspicious malicious activities, follow established internal procedures, and report incidents. Specific Remediation Steps: - Hubbell recommends users update the firmware to version v2.1.0.105 to minimize network exposure. - Update Link: Aclara Connect References CISA Advisory CISA ICS Alerts CISA Recommended Practices CISA Best Practices CISA Industrial Control Systems CISA Alert 10-301-02 NCIC ICS-CERT Defense in Depth Targeted Cyber Intrusion Detection Additional Information Release Date: June 23, 2026 Publisher: CISA Contact Email: central@cisa.dhs.gov Official Website: https://www.cisa.gov/ Code Block No POC or exploit code is provided.

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2026-1840: Hubbell Aclara Metrum Cellular Web Interface Missing Authentication Vulnerability

More from this source