{"id":"CVE-2026-1632","state":"PUBLISHED","title":"RISS SRL MOMA Seismic Station Missing Authentication for Critical Function","description":"MOMA Seismic Station Version v2.4.2520 and prior exposes its web management interface without requiring authentication, which could allow an unauthenticated attacker to modify configuration settings, acquire device data or remotely reset the device.","publishedAt":"2026-02-03T22:59:32.539Z","updatedAt":"2026-02-04T20:17:57.156Z","severity":{"score":9.3,"label":"Critical","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","source":"icscert"},"assigner":"icscert","products":["RISS SRL MOMA Seismic Station"],"affected":[{"vendor":"RISS SRL","product":"MOMA Seismic Station","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"Version v2.4.2520","versionType":"custom"}]}],"references":["https://www.cisa.gov/news-events/ics-advisories/icsa-26-034-03","https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-034-03.json"],"weaknesses":["CWE-306"],"ingestedAt":"2026-10-29T20:11:10.572Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/1xxx/CVE-2026-1632.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-1632","state":"PUBLISHED","datePublished":"2026-02-03T22:59:32.539Z","dateUpdated":"2026-02-04T20:17:57.156Z","assignerShortName":"icscert","assignerOrgId":"7d14cffa-0d7d-4270-9dc0-52cabd5a23a6","dateReserved":"2026-01-29T16:00:44.404Z"},"containers":{"cna":{"title":"RISS SRL MOMA Seismic Station Missing Authentication for Critical Function","descriptions":[{"lang":"en","value":"MOMA Seismic Station Version v2.4.2520 and prior exposes its web management interface without requiring authentication, which could allow an unauthenticated attacker to modify configuration settings, acquire device data or remotely reset the device."}],"affected":[{"vendor":"RISS SRL","product":"MOMA Seismic Station","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"Version v2.4.2520","versionType":"custom"}]}],"references":[{"url":"https://www.cisa.gov/news-events/ics-advisories/icsa-26-034-03"},{"url":"https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-034-03.json"}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":9.1,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]},{"cvssV4_0":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","baseScore":9.3,"baseSeverity":"CRITICAL","exploitMaturity":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-306","description":"CWE-306 Missing Authentication for Critical Function","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"icscert","orgId":"7d14cffa-0d7d-4270-9dc0-52cabd5a23a6","dateUpdated":"2026-02-03T22:59:32.539Z"},"credits":[{"lang":"en","type":"finder","value":"Souvik Kandar reported this vulnerability to CISA"}],"datePublic":"2026-02-03T19:00:00.000Z","source":{"advisory":"ICSA-26-034-03","discovery":"EXTERNAL"},"workarounds":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"RISS SRL did not respond to CISA's request for coordination. Users of \nRISS MOMA Seismic Station are encouraged to contact RISS SRL \n(info@riss-srl.com) for more information.\n\n<br>"}],"value":"RISS SRL did not respond to CISA's request for coordination. Users of \nRISS MOMA Seismic Station are encouraged to contact RISS SRL \n(info@riss-srl.com) for more information."}],"x_generator":{"engine":"Vulnogram 0.5.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-02-04T20:17:47.811407Z","id":"CVE-2026-1632","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-02-04T20:17:57.156Z"}}]}}}