Description
A vulnerability involving improper access control in the TSplus Remote Access web server that allows an unauthenticated remote attacker to access internal resources protected by manipulated paths through the /socket.io/JWN/ endpoint, bypassing the access restrictions intended for certain internal resources.
Published: 2026-10-14
Score: 8.7 High
EPSS: n/a
KEV: No
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

Vendor Solution

The vulnerabilities have been fixed by the TSplus team in the latest version.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 14 Oct 2026 11:00:00 +0000

Type Values Removed Values Added
Description A vulnerability involving improper access control in the TSplus Remote Access web server that allows an unauthenticated remote attacker to access internal resources protected by manipulated paths through the /socket.io/JWN/ endpoint, bypassing the access restrictions intended for certain internal resources.
Title Improper Access Control Allows Unauthorized Access to Protected Internal Web Resources in TSplus Remote Access
First Time appeared Tsplus
Tsplus tsplus Remote Access
Weaknesses CWE-552
CPEs cpe:2.3:a:tsplus:tsplus_remote_access:19.20.3.10:*:*:*:*:*:*:*
Vendors & Products Tsplus
Tsplus tsplus Remote Access
References
Metrics cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Tsplus Tsplus Remote Access
cve-icon MITRE

Status: PUBLISHED

Assigner: INCIBE

Published:

Updated: 2026-10-14T10:54:58.334Z

Reserved: 2026-10-09T11:47:00.728Z

Link: CVE-2026-108070

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-14T11:17:02.977

Modified: 2026-10-14T11:17:02.977

Link: CVE-2026-108070

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses
  • CWE-552

    Files or Directories Accessible to External Parties