Threat database

PrismX MX100 AP controller developed by BROWAN COMMUNICATIONS has an Insufficiently Protected Credentials vulnerability, allowing privileged remote attackers to allowing authenticated remote attackers to obtain SMTP plaintext passwords through the web frontend.

PrismX MX100 AP controller developed by BROWAN COMMUNICATIONS has an Arbitrary File Upload vulnerability, allowing privileged remote attackers to upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server.

CVE-2026-1221 is a critical vulnerability in the BROWAN COMMUNICATIONS PrismX MX100 AP controller caused by the use of hard-coded database credentials embedded in the firmware. This flaw allows unauthenticated remote attackers to log into the device's database without any user interaction or privileges, potentially leading to full compromise of the device. The vulnerability has a CVSS 4.0 score of 9.3, reflecting its high impact on confidentiality, integrity, and availability. Although no known exploits are currently reported in the wild, the ease of exploitation and critical severity make it a significant threat. European organizations using PrismX MX100 controllers in their network infrastructure could face risks including data breaches, unauthorized network access, and disruption of wireless services. Mitigation requires immediate firmware updates from the vendor or, if unavailable, network segmentation and strict access controls to isolate vulnerable devices. Countries with higher adoption of BROWAN COMMUNICATIONS products and critical infrastructure relying on wireless AP controllers are at greater risk. Given the critical nature and remote unauthenticated access, this vulnerability demands urgent attention from defenders.