CVE-2026-11848: IEI Integration Corp｜ iRM-IEI Remote Management - Missing Authentication

Synopsis

Missing authentication vulnerability in IEI Integration Corp iRM-IEI Remote Management allows unauthenticated remote attackers to reach a specific management function over the network without any credentials. Successful exploitation exposes partial system configuration information from the affected device. A patched-image rebuild at version 1.4.19 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the iRM-IEI management service over the network; no local or physical access is required.

• AuthenticationNot required

  No credentials of any privilege level are needed to trigger the vulnerable functionality.

• Victim interactionNot required

  The attacker can exploit this vulnerability without any action from a user or administrator on the target system.

• Attack complexityDetail

  The exploit is reliable and condition-free, with no race conditions or environmental dependencies required to succeed.

Blast Radius

• Reads partial system configuration details from the affected iRM-IEI device, which may include network settings, service parameters, or hardware identifiers useful for further targeting.
• Impacts the confidentiality of the managed system's configuration data at a low level on the vulnerable component itself.
• Compromises the confidentiality, integrity, and availability of any downstream or dependent systems that rely on or are managed by the iRM-IEI component (high scope impact on subsequent systems).
• An attacker who maps the exposed configuration data can use it as reconnaissance to plan more targeted follow-on attacks against connected infrastructure.