Intelbras Network Switch Authentication Bypass via Web Interface

A weakness has been identified in Intelbras SG 2404 PoE L2+ 1.00.70/1.00.72. The affected element is an unknown function of the file /EXCU_SHELL of the component Web Management Interface. Executing a manipulation can lead to improper authentication. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 1.00.74 is sufficient to fix this issue. Upgrading the affected component is advised.

Casky was already ahead

This CVE exploits attack patterns that Casky's 283matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

CVE-2026-124577 represents a critical authentication bypass vulnerability in Intelbras SG 2404 PoE L2+ switches affecting firmware versions 1.00.70 and 1.00.72. The flaw exists in the /EXCU_SHELL endpoint of the Web Management Interface, where an unknown function fails to properly validate user credentials, allowing remote attackers to bypass authentication controls entirely. This vulnerability is particularly severe because network infrastructure devices like managed switches are trusted perimeter components—compromising their authentication mechanisms grants attackers direct control over network segmentation, VLAN configuration, and traffic flow. Organizations deploying these switches in enterprise environments, data centers, and critical infrastructure face immediate risk of unauthorized administrative access, with no authentication barriers to exploit. The public availability of exploit code and CVSS score of 9.8 amplify the urgency for patching to version 1.00.74.

Casky's 754 security skills mapped to MITRE ATT&CK enable practitioners to detect the attack patterns underlying this vulnerability through techniques spanning TA0004 (Privilege Escalation) and TA0006 (Credential Access). Using Claude AI with extended reasoning, the platform would identify reconnaissance patterns associated with web management interface enumeration (TA0007), followed by exploitation attempts targeting the /EXCU_SHELL endpoint that bypass CWE-287 authentication checks. Practitioners utilizing Casky would see skill matches flagging suspicious HTTP requests to administrative interfaces lacking proper credential validation, unusual privilege elevation after failed authentication attempts, and lateral movement indicators suggesting attackers leveraging compromised switch access to pivot within network infrastructure. The 283 matching skills would help defenders correlate evidence of exploitation—such as unexpected administrative sessions, configuration changes without audit trail, or VLAN manipulation—enabling rapid detection and containment before attackers establish persistent network control.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

283 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-124577.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

cryptography · low

Run

MITRE ATT&CK Techniques

TA0004 TA0006

Investigate the attack patterns behind CVE-2026-124577

Casky has 283 skills that investigate the attack patterns behind CVE-2026-124577. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn