CVE-2026-13211 Overview
CVE-2026-13211 is an information disclosure vulnerability in the genucenter web interface before version 8.0p11. The interface returns Simple Network Management Protocol (SNMP) authentication and encryption keys inside HTTP responses delivered to users holding the Service or Admin role. This behavior exposes credential material that should never leave server-side storage. The issue is tracked under CWE-201: Insertion of Sensitive Information Into Sent Data.
Critical Impact
Authenticated users with Service or Admin roles can retrieve SNMP authentication and privacy keys directly from HTTP responses, enabling further access to managed SNMP infrastructure.
Affected Products
- genucenter web interface versions prior to 8.0p11
Discovery Timeline
- 2026-07-01 - CVE-2026-13211 published to the National Vulnerability Database (NVD)
- 2026-07-01 - Last updated in NVD database
Technical Details for CVE-2026-13211
Vulnerability Analysis
The genucenter web interface renders configuration data for authenticated administrators. When SNMP settings are viewed or edited, the backend includes the raw authentication key and privacy (encryption) key values in the HTTP response body. These keys should be treated as write-only secrets after initial configuration.
An authenticated user in the Service or Admin role can retrieve these keys by loading the relevant configuration page or by inspecting the underlying API response. The keys can then be reused to authenticate to SNMP endpoints managed by the appliance. This weakens the separation between application-level access and network device credentials.
The vulnerability requires valid low-privilege authentication and produces no direct impact on integrity or availability. Confidentiality of SNMP credential material is the sole affected property.
Root Cause
The root cause is a design flaw in how the web interface serializes SNMP configuration objects. Sensitive fields are returned to the client instead of being masked, redacted, or replaced with a placeholder. The application does not enforce a server-side policy that prevents secret material from being included in outbound responses.
Attack Vector
An attacker must first obtain credentials for a Service or Admin account on genucenter. Once authenticated, the attacker requests the SNMP configuration view or the associated API endpoint. The response contains the SNMP authentication key and encryption key in cleartext. The attacker then uses these keys to query or manipulate SNMP-enabled devices reachable from the network segment monitored by genucenter.
See the GitHub Security Advisory for full technical details.
Detection Methods for CVE-2026-13211
Indicators of Compromise
- HTTP responses from the genucenter web interface containing SNMPv3 authKey or privKey fields with non-empty values.
- Access log entries showing Service or Admin users retrieving SNMP configuration endpoints outside of scheduled change windows.
- Unexpected SNMPv3 authentication attempts against managed devices originating from hosts other than the genucenter appliance.
Detection Strategies
- Inspect web server access logs for requests to SNMP configuration paths and correlate with the authenticated user session.
- Monitor SNMP traps and authentication failures on managed devices for signs of credential reuse from unauthorized sources.
- Review browser or proxy captures during administrative sessions to confirm whether key material is returned to the client.
Monitoring Recommendations
- Enable audit logging for all Service and Admin role activity in genucenter and forward logs to a centralized SIEM.
- Alert on any read of SNMP configuration data by accounts that do not require it for daily operations.
- Track SNMPv3 usage patterns on managed network devices to baseline legitimate access.
How to Mitigate CVE-2026-13211
Immediate Actions Required
- Upgrade the genucenter web interface to version 8.0p11 or later.
- Rotate all SNMPv3 authentication and privacy keys configured through genucenter after upgrading.
- Review the list of accounts holding Service or Admin roles and remove any that are no longer required.
Patch Information
GENUA has addressed the vulnerability in genucenter version 8.0p11. Administrators should apply this update using the vendor's standard maintenance procedure. Refer to the GitHub Security Advisory for advisory identifier SBA-ADV-20260424-01.
Workarounds
- Restrict access to the genucenter web interface to a small set of trusted administrator workstations via network access control lists.
- Use unique SNMP credentials per managed device to limit the blast radius if keys are disclosed.
- Enforce multi-factor authentication for accounts assigned the Service or Admin role to raise the barrier to obtaining a valid session.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
