An origin validation error in the genieacs-mcp server allows unauthenticated remote attackers to perform unauthorized device management tasks via DNS rebinding.

The application incorrectly exposes an unauthenticated HTTP listener on the loopback address without validating Host or Origin headers. This allows a malicious website to use DNS rebinding to interact with the service, enabling unauthorized control over CPE management functions.

An attacker can exploit this to reboot devices, modify TR-069 parameters, or execute firmware tasks, causing significant operational disruption and loss of device control. The CVSS score of 8.8 highlights the critical risk to infrastructure management systems and the potential for large-scale device compromise.

Immediate Action: Update genieacs-mcp to version 0.3.2 or later to include necessary origin validation checks.

Proactive Monitoring: Review web server and application logs for unusual requests originating from unexpected origins or requests targeting the /mcp endpoint.

Compensating Controls: Restrict access to the MCP listener by binding it strictly to authorized interfaces and implement network-level controls to prevent unauthorized external access to the loopback service.

Public Exploit Available: Unknown

The severity of this vulnerability necessitates an immediate update to the patched version. Organizations managing GenieACS infrastructure should conduct a review of their network environment to ensure that management interfaces are not exposed to untrusted web content.