JVNVU#98103854
Multiple vulnerabilities in Micro Research MR-GM5L-S1 and MR-GM5A-L1

Overview

MR-GM5L-S1 and MR-GM5A-L1 provided by Micro Research Ltd. contain multiple vulnerabilities.

Products Affected

• MR-GM5L-S1 firmware versions prior to v2.01.04N1_02
• MR-GM5A-L1 firmware versions prior to v2.01.04N1_02

Description

MR-GM5L-S1 and MR-GM5A-L1 provided by Micro Research Ltd. contain multiple vulnerabilities listed below.

• Code injection (CWE-94)
  • CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N Base Score 8.6
  • CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H Base Score 7.2
  • CVE-2026-20892
• Use of hard-coded credentials (CWE-798)
  • CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N Base Score 9.3
  • CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Base Score 9.8
  • CVE-2026-24448
• Authentication bypass using an alternate path or channel (CWE-288)
  • CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N Base Score 9.3
  • CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Base Score 9.8
  • CVE-2026-27842

Impact

• An attacker with administrative privileges may execute arbitrary commands (CVE-2026-20892)
• An attacker may obtain administrative access (CVE-2026-24448)
• An attacker may bypass authentication and change the device configuration (CVE-2026-27842)

Solution

Update the firmware
Update the firmware to the latest version according to the information provided by the developer.