A vulnerability in Nishishi Tegalog versions 4.8.4 and earlier allows unauthenticated attackers to bypass authentication and access the management console due to a flawed regular expression.

The application utilizes a permissive regular expression (CWE-625) for authentication checks. This flaw allows an unauthenticated attacker to successfully bypass access controls and gain entry to the management interface.

The ability for an unauthenticated attacker to access the management console presents a critical risk to data confidentiality and administrative control. An attacker could potentially view, modify, or delete sensitive logs stored within the application. With a CVSS score of 8.6, this vulnerability is considered high severity and could lead to significant operational disruption if exploited.

Immediate Action: Update the Tegalog application to the latest version provided by Nishishi to resolve the authentication bypass.

Proactive Monitoring: Monitor access logs for unauthorized login attempts or administrative actions performed by unknown or suspicious source addresses.

Compensating Controls: Place the management console behind a VPN or a Web Application Firewall (WAF) to block unauthorized attempts to access the login page.

Public Exploit Available: Unknown

Security teams must treat this authentication bypass with high urgency. Immediately verify the version of Tegalog in use and apply the vendor-provided security update to prevent unauthorized administrative access.