CVE-2026-4767: Improper Access Control in TR7's WAF-ASP

Synopsis

An improper access control flaw (missing authentication for a critical function) affects TR7 Cyber Defense Inc. WAF-ASP versions from v1.0.324.900 up to but not including v1.4.0.117. The vulnerability is reachable over the network with no authentication required and no user interaction needed, making it trivially exploitable by any remote attacker who can reach the service. Successful exploitation gives an attacker full read, write, and denial-of-service capability against the affected WAF-ASP instance. A patched-image rebuild at v1.4.0.117 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be able to reach the WAF-ASP service over the network; no local or physical access is required.

• AuthenticationNot required

  No credentials or session token of any kind are needed; the vulnerable function is exposed without any authentication gate.

• Victim interactionNot required

  The attacker does not need to trick or involve any user; the exploit is entirely server-side.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special conditions, race windows, or knowledge of the target environment.

Blast Radius

• A successful attacker reads all data accessible to the WAF-ASP process, including intercepted request logs, session tokens, and any credentials stored or passed through the WAF.
• The attacker can write to or modify WAF configuration, rules, and persisted state, allowing bypass or manipulation of all traffic filtering the WAF enforces.
• The attacker can crash or disable the WAF-ASP service entirely, removing the web application firewall layer from in front of protected applications.
• Because scope is unchanged, impact is confined to the WAF-ASP instance itself, but that instance sits in a privileged network position, amplifying the downstream risk to protected services.