CYBERHAWK / CVE / CVE-2026-49973
CVE-2026-49973
CRITICAL
CVSS 9.4
other
The flaw
Hermes WebUI before version 0.51.358 contains an improper access control vulnerability that allows unauthenticated remote attackers to hijack initial setup by submitting the _set_password parameter to the settings API endpoint without any n
What to do
Review advisory and patch per vendor guidance.