{"id":"CVE-2026-1364","state":"PUBLISHED","title":"JNC｜IAQS and I6 - Missing Authentication","description":"IAQS and I6 developed by JNC has a Missing Authentication vulnerability, allowing unauthenticated remote attackers to directly operate system administrative functionalities.","publishedAt":"2026-01-23T08:41:44.752Z","updatedAt":"2026-01-23T15:22:25.213Z","severity":{"score":9.3,"label":"Critical","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","source":"twcert"},"assigner":"twcert","products":["JNC IAQS","JNC I6"],"affected":[{"vendor":"JNC","product":"IAQS","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected"}]},{"vendor":"JNC","product":"I6","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected"}]}],"references":["https://www.twcert.org.tw/tw/cp-132-10652-4cdca-1.html","https://www.twcert.org.tw/en/cp-139-10653-117a1-2.html"],"weaknesses":["CWE-306"],"ingestedAt":"2026-10-29T20:11:10.572Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/1xxx/CVE-2026-1364.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-1364","state":"PUBLISHED","datePublished":"2026-01-23T08:41:44.752Z","dateUpdated":"2026-01-23T15:22:25.213Z","assignerShortName":"twcert","assignerOrgId":"cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e","dateReserved":"2026-01-23T07:50:37.178Z"},"containers":{"cna":{"title":"JNC｜IAQS and I6 - Missing Authentication","descriptions":[{"lang":"en","value":"IAQS and I6 developed by JNC has a Missing Authentication vulnerability, allowing unauthenticated remote attackers to directly operate system administrative functionalities."}],"affected":[{"vendor":"JNC","product":"IAQS","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected"}]},{"vendor":"JNC","product":"I6","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected"}]}],"references":[{"url":"https://www.twcert.org.tw/tw/cp-132-10652-4cdca-1.html","tags":["third-party-advisory"]},{"url":"https://www.twcert.org.tw/en/cp-139-10653-117a1-2.html","tags":["third-party-advisory"]}],"metrics":[{"cvssV4_0":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","baseScore":9.3,"baseSeverity":"CRITICAL","exploitMaturity":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]},{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-306","description":"CWE-306 Missing Authentication for Critical Function","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"twcert","orgId":"cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e","dateUpdated":"2026-01-23T08:41:44.752Z"},"datePublic":"2026-01-23T08:38:00.000Z","impacts":[{"capecId":"CAPEC-1","descriptions":[{"lang":"en","value":"CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs"}]}],"solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"The vendor has released a patch for devices using the M4 chip. Devices using the M3 chip do not support the update and are recommended to be replaced. Please contact the vendor to confirm which chip the device uses and take the appropriate actions accordingly.<br>"}],"value":"The vendor has released a patch for devices using the M4 chip. Devices using the M3 chip do not support the update and are recommended to be replaced. Please contact the vendor to confirm which chip the device uses and take the appropriate actions accordingly."}],"source":{"advisory":"TVN-202601009","discovery":"EXTERNAL"},"x_generator":{"engine":"Vulnogram 0.5.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-01-23T15:22:14.067179Z","id":"CVE-2026-1364","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-01-23T15:22:25.213Z"}}]}}}