Skip to content
OpenAdvisories
Medium VDE-2026-047 1 CVE

VEGA: Missing Authentication for critical function in VEGAPULS Air products

Published May 4, 2026 · Updated Oct 2, 2026 · Revision 4

Vendor: vega Product: CVE Reference Score Product: VEGAPULS Air 41 Cellular (NB-IoT/LTE-M) Product: VEGAPULS Air 41 Cellular (NB-IoT/LTE-M) + LoRa Product: VEGAPULS Air 41 LoRa Product: VEGAPULS Air 42 Cellular (NB-IoT/LTE-M) Product: VEGAPULS Air 42 Cellular (NB-IoT/LTE-M) + LoRa Product: VEGAPULS Air 42 LoRa

Summary

Vulnerable components expose sensitive information to unauthorized actors through an unsecured configuration interface. Vulnerable firmware releases contain an unsecured configuration interface that allows retrieval of sensitive information such as hashed credentials.

It was found that users with no or low rights can access information from devices that should not be available to them.

An attacker can use this information to impersonate authorized users.

Details

Impact
An authenticated attacker can obtain sensitive information, potentially enabling authenticated device modification.

Mitigation
Implement access controls for interfaces to prevent unauthorized access.

Remediation
Update to the fixed firmware versions listed in this advisory. Rotate any credentials used on affected devices as they may have been compromised. Contact VEGA Support if emergency code rotation is necessary based on your risk assessment.

Fixed Versions:
* Firmware 2.2.1 installed on VEGAPULS Air 41 Cellular (NB-IoT/LTE-M) + LoRa
* Firmware 2.2.1 installed on VEGAPULS Air 41 Cellular (NB-IoT/LTE-M)
* Firmware 2.2.1 installed on VEGAPULS Air 41 LoRa
* Firmware 2.2.1 installed on VEGAPULS Air 42 Cellular (NB-IoT/LTE-M) + LoRa
* Firmware 2.2.1 installed on VEGAPULS Air 42 Cellular (NB-IoT/LTE-M)
* Firmware 2.2.1 installed on VEGAPULS Air 42 LoRa

Vulnerabilities 1

Revision history

  1. #1.0.3

    Fixed version range name and vendor name

  2. #1.0.2

    Added fixed Versions to Remediation document notes

  3. #1.0.1

    Updated Title

  4. #1.0.0

    Initial Release

References