A critical authentication bypass vulnerability in Micro Research Ltd. industrial networking devices allows unauthenticated remote attackers to gain unauthorized control over device configurations.

This is an authentication bypass (CWE-288) that allows an unauthenticated attacker to interact with the device as if they were a legitimate administrator. The vulnerability leverages an alternate path or channel to circumvent standard login procedures.

Successful exploitation allows an adversary to alter critical device configurations, which could lead to unauthorized network access, traffic interception, or the total compromise of the affected network infrastructure. With a CVSS score of 9.8, this vulnerability poses a severe risk to operational continuity and data integrity.

Immediate Action: Upgrade all affected MR-GM5L-S1 and MR-GM5A-L1 units to firmware version v2.01.04N1_02 or later immediately.

Proactive Monitoring: Review device access logs for unauthorized configuration changes and monitor network traffic for suspicious management requests originating from untrusted sources.

Compensating Controls: Restrict management interface access to trusted internal IP addresses using hardware firewalls or ACLs to prevent exposure to the public internet.

Public Exploit Available: No (exploit_available: false)

Given the critical nature of this authentication bypass and the potential for full device control, immediate patching is required. Organizations should prioritize firmware updates for all internet-facing or critical infrastructure deployments of these devices to eliminate the risk of unauthorized configuration manipulation.