{"id":"CVE-2026-1363","state":"PUBLISHED","title":"JNC｜IAQS and I6 - Client-Side Enforcement of Server-Side Security","description":"IAQS and I6 developed by JNC has a Client-Side Enforcement of Server-Side Security vulnerability, allowing unauthenticated remote attackers to gain administrator privileges by manipulating the web front-end.","publishedAt":"2026-01-23T08:37:32.451Z","updatedAt":"2026-01-23T15:27:56.307Z","severity":{"score":9.3,"label":"Critical","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","source":"twcert"},"assigner":"twcert","products":["JNC IAQS","JNC I6"],"affected":[{"vendor":"JNC","product":"IAQS","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected"}]},{"vendor":"JNC","product":"I6","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected"}]}],"references":["https://www.twcert.org.tw/tw/cp-132-10652-4cdca-1.html","https://www.twcert.org.tw/en/cp-139-10653-117a1-2.html"],"weaknesses":["CWE-603"],"ingestedAt":"2026-10-29T20:11:10.572Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/1xxx/CVE-2026-1363.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-1363","state":"PUBLISHED","datePublished":"2026-01-23T08:37:32.451Z","dateUpdated":"2026-01-23T15:27:56.307Z","assignerShortName":"twcert","assignerOrgId":"cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e","dateReserved":"2026-01-23T07:50:35.310Z"},"containers":{"cna":{"title":"JNC｜IAQS and I6 - Client-Side Enforcement of Server-Side Security","descriptions":[{"lang":"en","value":"IAQS and I6 developed by JNC has a Client-Side Enforcement of Server-Side Security vulnerability, allowing unauthenticated remote attackers to gain administrator privileges by manipulating the web front-end."}],"affected":[{"vendor":"JNC","product":"IAQS","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected"}]},{"vendor":"JNC","product":"I6","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected"}]}],"references":[{"url":"https://www.twcert.org.tw/tw/cp-132-10652-4cdca-1.html","tags":["third-party-advisory"]},{"url":"https://www.twcert.org.tw/en/cp-139-10653-117a1-2.html","tags":["third-party-advisory"]}],"metrics":[{"cvssV4_0":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","baseScore":9.3,"baseSeverity":"CRITICAL","exploitMaturity":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]},{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-603","description":"CWE-603 Use of Client-Side Authentication","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"twcert","orgId":"cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e","dateUpdated":"2026-01-23T08:37:32.451Z"},"datePublic":"2026-01-23T07:57:00.000Z","impacts":[{"capecId":"CAPEC-114","descriptions":[{"lang":"en","value":"CAPEC-114 Authentication Abuse"}]}],"solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"The vendor has released a patch for devices using the M4 chip. Devices using the M3 chip do not support the update and are recommended to be replaced. Please contact the vendor to confirm which chip the device uses and take the appropriate actions accordingly.<br>"}],"value":"The vendor has released a patch for devices using the M4 chip. Devices using the M3 chip do not support the update and are recommended to be replaced. Please contact the vendor to confirm which chip the device uses and take the appropriate actions accordingly."}],"source":{"advisory":"TVN-202601009","discovery":"EXTERNAL"},"x_generator":{"engine":"Vulnogram 0.5.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-01-23T15:22:46.951681Z","id":"CVE-2026-1363","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-01-23T15:27:56.307Z"}}]}}}