CVE-2026-46459: Missing Authorization in ICU Scandinavia Boomerang

Severity: medium (CVSS 5.3 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-07-15 · updated 2026-10-24
Weakness: CWE-862

Description

ICU Scandinavia Boomerang is vulnerable to a missing authentication flaw in its device receiver endpoints. This allows an unauthenticated remote attacker to read full facility configurations and write unauthorized data to the sensor database. This issue has been fixed in version 2.4.18.029

Affected products

ICU Scandinavia Boomerang: before 2.4.18.029 — fixed in 2.4.18.029

How to fix

Upgrade to a fixed version: ICU Scandinavia Boomerang 2.4.18.029. Check the vendor advisory for mitigations.

References

https://cert.pl/posts/2026/07/CVE-2026-46458
https://icuscandinavia.se/boomerang-quality-assurance-lab/

Get alerted when CVE-2026-46459 or the next vulnerability affects your stack