The vulnerability identified as CVE-2026-75108 in Next Terminal involves a failure to enforce per-asset authorization on the portal ping and wake-on-LAN endpoints. Authenticated users can exploit this by invoking these endpoints with arbitrary asset identifiers, enabling them to gather sensitive asset information and trigger wake-on-LAN packets on assets without proper access rights. This issue corresponds to CWE-862 (Missing Authorization). The CVSS v3.1 base score is 5.4, indicating a medium severity vulnerability with network attack vector, low attack complexity, requiring privileges, no user interaction, and impacts on confidentiality and integrity but not availability.

An attacker with valid authentication can probe unauthorized assets to obtain information such as display names, network addresses, reachability status, and connection timing. Additionally, they can send wake-on-LAN packets to these assets, potentially causing unintended device wake-ups. The confidentiality and integrity of asset information are impacted, but availability is not affected. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor vendor communications for updates. In the meantime, restrict authenticated user permissions as much as possible to limit exposure to this vulnerability.