CVE-2026-21635

Medium · 6.5

CVSS

6.5

EPSS

0.1%

Published

Jan 5, 2026

CISA due date

—

The record

An Improper Access Control could allow a malicious actor in Wi-Fi range to the EV Station Lite (v1.5.2 and earlier) to use WiFi AutoLink feature on a device that was only adopted via Ethernet.

Affected packages

Ecosystem	Package	Introduced	Fixed