LiveThreat Vulnerability Brief — CVE‑2026‑1775 (Labkotec LID‑3300IP)
What It Is — Labkotec’s LID‑3300IP ice‑detector controller contains a missing‑authentication flaw that lets an unauthenticated network attacker send crafted packets to alter device parameters and execute operational commands. The vulnerability scores 9.4 (Critical) on the CVSS v3.1 scale and is publicly disclosed in a CISA advisory. Exploitability — Proof‑of‑concept packets have been shared publicly; no known active ransomware‑style exploit, but the attack vector is trivial for any adversary with network access.
Affected Products — Labkotec LID‑3300IP (all firmware versions) and LID‑3300IP Type 2 devices running firmware < V2.20.
TPRM Impact — The devices are deployed worldwide in communications and energy critical‑infrastructure sectors; a compromise could disrupt service, cause safety hazards, and cascade to downstream suppliers that rely on accurate ice‑detection data.
Recommended Actions — 1) Inventory all Labkotec LID‑3300IP units across your supply chain. 2) Prioritize replacement of legacy Type 2 units with the latest hardware and apply firmware V2.40. 3) Enforce network segmentation and restrict inbound traffic to trusted management subnets. 4) Enable HTTPS on upgraded devices and monitor for anomalous packet patterns. 5) Verify vendor‑provided remediation documentation and update contractual security clauses. Source: CISA Advisory – ICSA‑26‑062‑05