CVE-2026-28165: CWE-266 Incorrect Privilege Assignment in UnitedOver, LLC Digits

CVE-2026-28165 describes an unauthenticated privilege escalation vulnerability in Digits software versions <= 9.2 by UnitedOver, LLC. The root cause is incorrect privilege assignment (CWE-266), which enables attackers without authentication to gain elevated privileges. The CVSS 3.1 score of 9.8 reflects network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No vendor remediation level or patch information is provided in the available data.

Successful exploitation allows unauthenticated attackers to escalate privileges, potentially leading to full system compromise including unauthorized access to sensitive data, modification of system resources, and disruption of service. The critical CVSS score indicates a severe risk to affected systems.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected Digits installations and monitor for unusual activity. Avoid exposing vulnerable versions to untrusted networks where possible.