A critical authentication bypass vulnerability in the Panabit PAP-XM320 embedded HTTP server allows unauthenticated attackers to gain unauthorized access to the system.

The embedded HTTP server improperly validates session cookies by checking for file existence using user-controlled input. This allows for directory traversal and successful bypass of authentication.

With a CVSS score of 9.8, this vulnerability represents an existential threat to the device, as an attacker can gain full administrative access without credentials. This can lead to the complete compromise of the network appliance and any traffic passing through it.

Immediate Action: Update the Panabit PAP-XM320 firmware to the latest version provided by the manufacturer.

Proactive Monitoring: Monitor management interface access logs for signs of directory traversal attempts or unauthorized login bypasses.

Compensating Controls: Place the device management interface behind a VPN or restricted network segment to prevent exposure to untrusted networks.

Public Exploit Available: false

The ability to bypass authentication on a network appliance is extremely high risk. Organizations using the Panabit PAP-XM320 must prioritize firmware updates and ensure the management interface is not accessible from the public internet.