CVE-2026-46459
Missing Authorization in ICU Scandinavia Boomerang
- State
- Published
- Severity
- 5.3 Medium
- Published
- Jul 15, 2026
- Updated
- Jul 15, 2026
- Reserved
- May 14, 2026
Description
ICU Scandinavia Boomerang is vulnerable to a missing authentication flaw in its device receiver endpoints. This allows an unauthenticated remote attacker to read full facility configurations and write unauthorized data to the sensor database. This issue has been fixed in version 2.4.18.029
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 5.3 Medium | CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N | CERT-PL |
Weaknesses
- CWE-862 Missing Authorization
Affected Products
| Product | Versions |
|---|---|
BoomerangICU Scandinavia |
|
References
- https://cert.pl/posts/2026/07/CVE-2026-46458third-party-advisory
- https://icuscandinavia.se/boomerang-quality-assurance-lab/product
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.