CVE-2026-8214
Industrial Application Software IAS Canias ERP RMI doAction improper authentication
- State
- Published
- Severity
- 6.9 Medium
- Published
- May 10, 2026
- Updated
- May 11, 2026
- Reserved
- May 9, 2026
Description
A vulnerability was found in Industrial Application Software IAS Canias ERP 8.03. This affects the function doAction of the component RMI Interface. The manipulation of the argument sessionId results in improper authentication. It is possible to launch the attack remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 6.9 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P | VulDB |
| 3.1 | 5.3 Medium | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R | VulDB |
| 3.0 | 5.3 Medium | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R | VulDB |
| 2.0 | 5.0 Medium | AV:N/AC:L/Au:N/C:P/I:N/A:N/E:POC/RL:ND/RC:UR | VulDB |
Weaknesses
- CWE-287 Improper Authentication
Affected Products
| Product | Versions |
|---|---|
Canias ERPIndustrial Application Software IAS |
|
References
- VDB-362431 | Industrial Application Software IAS Canias ERP RMI doAction improper authenticationvdb-entrytechnical-description
- VDB-362431 | CTI Indicators (IOB, IOC, IOA)signaturepermissions-required
- Submit #808238 | Industrial Application Software - IAS Canias ERP 8.03-- Information Disclosurethird-party-advisory
- https://hawktrace.com/blog/caniaserp/related
- https://gist.github.com/0xb1lal/3ef872a445310c5866d07d6a5b1803fabroken-linkexploit
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.