CVE-2026-2624

CRITICAL

Authentication Bypass in ePati's Antikor NGFW

Title source: CVE List
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2026-2624 has a selected CVSS score of 9.8 (critical); EIP currently links 1 catalogued exploit.

Description

Missing Authentication for Critical Function vulnerability in ePati Cyber Security Technologies Inc. Antikor Next Generation Firewall (NGFW) allows Authentication Bypass. This issue affects Antikor Next Generation Firewall (NGFW): from v.2.0.1298 before v.2.0.1301.

Description source: CVE List

Exploitation context

Available material

Catalogued exploits
1

CISA SSVC decision

ExploitationNone
AutomatableYes
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Feb 25, 2026 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

Antikor Next Generation Firewall (NGFW)

Browse ePati Cyber Security Technologies Inc. / Antikor Next Generation Firewall (NGFW)

Default status: unaffected

CVE Listv.2.0.1298 to < v.2.0.1301affected

Proofs of concept

1

Catalogued exploits

ExploitDBePati Antikor NGFW 2.0.1301 - Authentication BypassExploitDB exploitby Sadık ErtürkExploit1 file
ExploitDB
PoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

Python script that connects to an ePati Antikor NGFW WebSocket endpoint without authentication and sends commands to leak cluster status and network packet data.

Backdoor review

No backdoor observed in reviewed code

The PoC script connects to a target WebSocket, sends two JSON payloads to trigger the reported authentication bypass (CVE-2026-2624), and prints the responses. No backdoor, concealed executable behavior, or operator-directed harm is present.

ClassificationExploit
Model confidence95%
AuthenticationNot required
LanguagesPython
Target softwareePati Antikor Next Generation Firewall (NGFW)
Attack typesAuthentication BypassInformation Disclosure
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The script actively connects to a target, sends commands that extract sensitive data (cluster status and network packets), and prints the results. This constitutes exploitation, not mere detection or scanning.

exploits/multiple/webapps/52562.txt:1exploits/multiple/webapps/52562.txt:29-70

Requirements

  • Target ePati Antikor NGFW instance running a vulnerable version (v.2.0.1298 to v.2.0.1301) with WebSocket service accessible on the specified port (default 8800).exploits/multiple/webapps/52562.txt:6-7exploits/multiple/webapps/52562.txt:34exploits/multiple/webapps/52562.txt:86

Observed behavior

  • Generates random server and session IDs to construct a SockJS WebSocket URL.exploits/multiple/webapps/52562.txt:30-34
  • Connects to the target WebSocket server without providing any authentication credentials, bypassing SSL certificate validation.exploits/multiple/webapps/52562.txt:39-41
  • Sends a JSON command 'rapor-dinle' with parameter 'cluster-durum' to listen to cluster status.exploits/multiple/webapps/52562.txt:45-47
  • Receives and prints the server response containing sensitive system data.exploits/multiple/webapps/52562.txt:51-55
  • Sends a second JSON command 'paket-liste-dinle' to listen to network packet data.exploits/multiple/webapps/52562.txt:58-60
  • Receives and prints the server response containing captured network packet data.exploits/multiple/webapps/52562.txt:63-67
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Network Connection
Payload withheldThe script connects to a user-supplied target to demonstrate the authentication bypass vulnerability.exploits/multiple/webapps/52562.txt:34-41
Payload
Payload withheldFirst payload sent to the target to listen to cluster status, consistent with the described vulnerability.exploits/multiple/webapps/52562.txt:45-47
Payload
Payload withheldSecond payload sent to the target to listen to network packets, consistent with the described vulnerability.exploits/multiple/webapps/52562.txt:58-60
Review boundaries

What the analysis did not establish

  • Only the single text file 52562.txt was analyzed; no external dependencies or referenced resources were inspected.
  • The code was not executed; classification is based solely on static analysis of the provided source.
  • Only the supplied text file was reviewed; no external dependencies (e.g., websocket library) were inspected.
  • The script's behavior depends on the target server's response, which is not controlled by the PoC.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

References

3