CVE-2026-22096

Executive Summary

CVE-2026-22096 is a critical missing-authentication vulnerability affecting a webserver component within DIVD-managed infrastructure, listening on TCP port 8090. The webserver endpoints require no authentication, enabling remote unauthenticated attackers to leak sensitive configuration data — including plaintext passwords — and upload arbitrary files through exposed upload functionality. With a CVSS score of 9.3 (Critical) and network-based attack vector requiring no privileges, this vulnerability likely exposes credentials and allows file upload leading to potential remote code execution or data compromise. Impacted parties include organizations using DIVD-affiliated appliances or services; however, specific affected products or versions have not been publicly identified.

Technical Analysis

The vulnerability is rooted in the webserver listening on port 8090, which lacks authentication controls across its endpoints. The NVD description confirms two primary capabilities exposed by this flaw:

1. Sensitive Information Leakage: Unauthenticated access to endpoints that return configuration data, including configured passwords. This likely stems from the webserver serving configuration files or diagnostic endpoints that echo sensitive settings without access control checks. The data exposure may include hashed or plaintext credentials used for upstream system integration.

2. Arbitrary File Upload: The server exposes file-upload endpoints that accept and store attacker-controlled files without authentication. This is likely an administrative or maintenance feature intended for firmware updates, configuration import, or log collection — inadvertently left accessible.

The attack surface is defined by the network exposure of port 8090. Since this port is accessible over the network, any internet-reachable device or service running this webserver is vulnerable. The absence of authentication (CWE-306) is the root cause, meaning the server performs no validation of user identity before processing requests to these sensitive endpoints.

The combination of credential leakage and arbitrary file upload is particularly dangerous. Credential theft alone allows for lateral movement or access to downstream systems, while file upload (depending on where files are stored and how the server processes them) can lead to remote code execution if uploaded files are stored in web-accessible directories or are processed by the application (e.g., as templates, scripts, or configuration files).

Affected product details remain unclear, as the NVD record attributes the CVE to DIVD — likely the Dutch Institute for Vulnerability Disclosure — but does not name a specific product. Given DIVD's work exposing vulnerabilities in network-connected devices (e.g., routers, IoT appliances, industrial systems), this flaw may exist in a vendor product that DIVD identified and reported, but the actual vendor attribution has not yet been updated in public records.

Exploitation Scenarios

Scenario: Remote Credential Exfiltration and File Upload

Step 1 — Reconnaissance. The attacker performs internet-wide scanning for TCP port 8090 using masscan or Zmap to identify exposed hosts. Shodan queries such as port:8090 can be used to locate vulnerable devices. The attacker fingerprints the webserver via HTTP response headers and page content to determine if this is a DIVD-affiliated service. No authentication is required, meaning a simple curl http://target:8090/ will reveal the server's behavior.

Step 2 — Credential Leakage. The attacker sends HTTP GET requests to configuration or status endpoints (e.g., /config, /settings, /status, /debug). These endpoints return configuration data without authentication. The attacker parses responses for password=, passwd=, api_key=, or token= fields. Identified credentials are then tested against other services belonging to the same organization — VPN portals, email gateways, or adjacent administrative interfaces.

Step 3 — File Upload. The attacker enumerates upload endpoints via HTTP OPTIONS or directory brute-force, discovering an unauthenticated file-upload interface. Using curl -F "file=@malicious.php" http://target:8090/upload, the attacker uploads a malicious payload. The file is stored on the server's filesystem.

Step 4 — Execution and Lateral Movement. If the uploaded file is stored in a web-accessible location (e.g., /uploads/ or /data/), the attacker retrieves it via http://target:8090/uploads/malicious.php, potentially triggering code execution if the server processes server-side files. Alternatively, the attacker uses the leaked configuration passwords to authenticate to other management interfaces (SSH, admin panels) and maintain persistent access.

Post-Exploitation Impact. With code execution or elevated access, the attacker can pivot to internal networks, deploy ransomware, or exfiltrate sensitive data. Since the device may be part of a managed infrastructure, a compromise may cascade to other managed devices.

Impact Assessment

The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) indicates a network-based, low-complexity attack with no required privileges or user interaction, and a high impact on confidentiality, integrity, and availability. With the highest possible unauthenticated severity score of 9.3, this vulnerability is considered critical.

Confidentiality Impact (High): Exposure of configured passwords and other credentials could grant attackers access to both the affected device and downstream systems. Credentials may include those for email, databases, or other infrastructure components managed by DIVD or its partners.

Integrity Impact (High): Arbitrary file upload enables modification of server content, injection of malicious files, or replacement of legitimate configuration files. This could lead to persistent backdooring of the device.

Availability Impact (High): Attackers may delete or overwrite critical files, rendering the service inoperable or unstable.

The blast radius is organization-wide: any enterprise relying on DIVD infrastructure or exposed devices port 8090. Without clear product identification, enterprises cannot easily determine if they are affected. Since no patch exists, the risk persists indefinitely until the vendor releases a fix.

Detection Guidance

Sigma Rule

title: CVE-2026-22096 - Unauthenticated Access to DIVD Webserver Port 8090
id: 2f0e8f40-8b5e-4c3a-9d21-d9d4b8b53f00
status: experimental
description: Detects unauthenticated HTTP requests to configuration or upload endpoints on port 8090, potential exploitation of CVE-2026-22096.
author: Valters IT Security Team
date: 2025-01-08
logsource:
    category: webserver
    product: apache
    service: httpd
detection:
    selection_destination:
        destination.port: 8090
    selection_methods:
        http.method:
            - 'GET'
            - 'POST'
            - 'PUT'
    selection_paths:
        http.url|contains:
            - '/config'
            - '/settings'
            - '/upload'
            - '/status'
            - '/debug'
    filter_auth_success:
        http.response.status_code: 401
        http.response.status_code: 403
    condition: selection_destination and selection_methods and selection_paths and not filter_auth_success
level: high
falsepositives:
    - Legitimate administrative access to DIVD-managed devices
    - Health checks or monitoring tools

YARA Rule

rule CVE_2026_22096_DIVD_Webserver_Config_Exposure
{
    meta:
        author = "Valters IT Security Team"
        description = "Detects HTTP responses from DIVD webserver (CVE-2026-22096) exposing sensitive configuration data"
        cve = "CVE-2026-22096"
        date = "2025-01-08"
    strings:
        $config_marker = "configured passwords"
        $upload_marker = "upload"
        $password_field = /password[=:] ?([^\s<>]{4,})/
        $token_field = /api[_-]?key[=:] ?([^\s<>]{4,})/
        $auth_missing = "authentication required"
    condition:
        any of them and uint16(0) == 0x4854  // "HT" - HTTP response
}

Suricata IDS Rule

alert http any any -> any 8090 (msg:"CVE-2026-22096 - Unauthenticated Access to DIVD Webserver Configuration"; flow:to_server,established; content:"GET"; http_method; content:"/config"; http_uri; nocase; content:"/settings"; http_uri; nocase; content:"/upload"; http_uri; nocase; sid:20262209601; rev:1; metadata:attack_target Server, deployment Perimeter, signature_severity Critical, created_at 2025_01_08, cve CVE-2026-22096; reference:url, https://nvd.nist.gov/vuln/detail/CVE-2026-22096;)

alert http any any -> any 8090 (msg:"CVE-2026-22096 - Potential File Upload to DIVD Webserver"; flow:to_server,established; content:"POST"; http_method; content:"filename"; http_client_body; nocase; content:"Content-Type"; http_header; sid:20262209602; rev:1; metadata:attack_target Server, deployment Perimeter, signature_severity Critical, created_at 2025_01_08, cve CVE-2026-22096; reference:url, https://nvd.nist.gov/vuln/detail/CVE-2026-22096;)

Elastic Detection

sequence by source.ip, destination.ip with maxspan=5m
  [network where destination.port == 8090 and network.transport == "tcp" and network.direction == "egress"]
  [http where url.path in ("/config", "/settings", "/upload", "/status", "/debug") and http.request.method in ("GET", "POST", "PUT") and not http.response.status_code in (401, 403)]
  [http where url.path == "/upload" and http.request.method == "POST" and http.request.body.content_type == "multipart/form-data"]

Splunk SPL Query

index=web sourcetype=access_combined dest_port=8090
| search (uri_path="/config" OR uri_path="/settings" OR uri_path="/upload" OR uri_path="/status" OR uri_path="/debug") 
    AND (method=GET OR method=POST OR method=PUT) 
    AND status!=401 AND status!=403
| stats count by src_ip, dest_ip, uri_path, method, status
| sort - count
| where count > 5
| rename src_ip as "Attacker IP", dest_ip as "Target IP", uri_path as "Requested Path"
| table Attacker IP, Target IP, Requested Path, method, status, count

Wazuh OSSEC Rule

<group name="web,attack,">
    <rule id="100220" level="12">
        <decoded_as>json</decoded_as>
        <field name="dest_port">8090</field>
        <field name="url">\.(config|settings|upload|status|debug)|/config|/settings|/upload|/status|/debug</field>
        <match>GET|POST|PUT</match>
        <description>CVE-2026-22096: Potential unauthenticated access to DIVD webserver endpoints on port 8090</description>
        <group>web_application_attack,cve-2026-22096,</group>
        <mitre><id>T1190</id><name>Exploit Public-Facing Application</name></mitre>
    </rule>
</group>

Mitigation & Patch Guidance

Patch Status: UNPATCHED — no patch evidence from any tracked source. The vendor DIVD has not released a fix for this vulnerability as of this report.

Immediate Mitigations:

1. Network Restriction: Implement firewall rules to restrict access to port 8090. If the service does not need to be internet-exposed, block inbound traffic to port 8090 from all sources except trusted administrative IP addresses. This is the most effective immediate mitigation given the lack of a patch.
2. Access Control Layer: Deploy a reverse proxy or WAF in front of port 8090 that enforces authentication before forwarding requests to the backend webserver. This can provide an intermediate authentication layer without requiring changes to the vulnerable application.
3. Monitor and Audit: Enable logging on the webserver and monitor access to port 8090 for unusual activity, particularly requests to configuration or upload endpoints from unexpected sources. Refer to the detection rules above.
4. Isolate the Service: If the service cannot be taken offline, isolate it on a segmented network segment to limit the blast radius of a potential compromise.

Patch/Upgrade Steps:

• Since no patch is available, contact the DIVD vendor or product maintainer for guidance on remediation.
• Monitor vendor advisories and NVD for updates to CVE-2026-22096. Subscribe to DIVD's security advisory mailing list for notification of available fixes.
• If the affected device supports firmware updates, check for newer versions that may address this vulnerability.

Long-Term Hardening:

1. Disable Unused Features: If the webserver on port 8090 provides only diagnostic or configuration functionality, consider disabling it entirely or limiting it to localhost-only access.
2. Implement Authentication: When a patch is available, verify that authentication is enforced on all endpoints. For any custom devices, perform a security review to ensure all management interfaces require credentials.
3. Credential Rotation: Assume any credentials exposed through this vulnerability may be compromised. Rotate all passwords and secrets that were stored in the configuration of the device, plus any credentials for adjacent systems.
4. Security Monitoring: Add port 8090 to your continuous security monitoring program. Use the detection artifacts provided above to alert on any unauthenticated access attempts.
5. Vendor Disclosure: If this vulnerability affects a product you deploy in production, coordinate with the vendor for an expedited fix. Consider adding this CVE to your exception tracking list until a patch is available.

References

1. NVD — https://nvd.nist.gov/vuln/detail/CVE-2026-22096
2. CWE-306 — https://cwe.mitre.org/data/definitions/306.html
3. DIVD (Dutch Institute for Vulnerability Disclosure) — https://www.divd.nl/
4. MITRE ATT&CK T1190 — https://attack.mitre.org/techniques/T1190/

No known threat-actor campaigns or exploit-in-the-wild evidence is publicly documented for CVE-2026-22096 at the time of this report. The PoC status is listed as "Public" but no exploit code or Nuclei template has been released. The CVE is not listed on CISA's Known Exploited Vulnerabilities (KEV) catalog.