Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.5

Wellav Emergency Broadcast Terminals may leak data to remote attackers

CVE-2026-52622 · published 1 month ago
Summary

The Wellav WES100, WES270, WES280, and WES290 emergency broadcast terminals can expose sensitive information to an attacker who connects over the network. This happens because the devices’ internal API can be accessed without proper checks. Update the terminals to the version released after August 8 2023, or apply the vendor’s recommended configuration changes, to block the unwanted access.

Original advisory text
An issue in Wellav Technologies Co., Ltd Wellav WES Emergency Broadcast Terminal WES100, WES270, WES280, and WES290 before 08-08-2023 allows a remote attacker to obtain sensitive information via th...
An issue in Wellav Technologies Co., Ltd Wellav WES Emergency Broadcast Terminal WES100, WES270, WES280, and WES290 before 08-08-2023 allows a remote attacker to obtain sensitive information via the global API request wrapper function
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
7.5 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-200Information Exposure
Timeline
Published25 Sep 2026
Updated4 Nov 2026
First seen25 Sep 2026
Sources
CVE-2026-52622 · NVD
CVE-2026-52622 · MITRE
Track software like this
Free during beta