SHARP routers voeren geen authenticatie uit voor sommige web API's. Apparaat informatie kan worden opgehaald zonder authenticatie. Als het beheerderswachtwoord van het apparaat op de initiële waarde blijft staan,

The primary impact of CVE-2026-32326 is the potential for unauthorized access to sensitive device information. An attacker exploiting this vulnerability can retrieve configuration details, network settings, and potentially user data stored on the router. Critically, if the administrator has left the default password unchanged, the attacker can gain full administrative control over the router, enabling them to modify settings, intercept network traffic, and launch further attacks against devices on the network. This represents a significant security risk, particularly for home networks and small businesses relying on the router for internet connectivity and security.

Home users and small businesses utilizing SHARP home 5G HR01 routers, particularly those who have not changed the default administrator password, are at significant risk. Shared hosting environments utilizing these routers for customer internet access are also vulnerable.

1. 2026-03-25Disclosure

   disclosure

1. Gereserveerd2026-03-12
2. Gepubliceerd2026-03-25
3. EPSS bijgewerkt2026-04-01

The primary mitigation for CVE-2026-32326 is to upgrade the SHARP HR01 router to a firmware version that addresses the authentication bypass. SHARP has not yet released a fixed firmware version, so users should monitor the SHARP support website for updates. As a temporary workaround, changing the default administrator password is crucial to prevent unauthorized access. Consider implementing network segmentation to limit the impact of a potential compromise. Regularly review router logs for suspicious activity.