EUVD-2026-14960

A Missing Authentication for Critical Function vulnerability in Pharos Controls Mosaic Show Controller firmware version 2.15.3 could allow an unauthenticated attacker to bypass authentication and execute arbitrary commands with root privileges...

CVE-2026-2417 Missing Authentication for Critical Function in Pharos Controls Mosaic Show Controller

A Missing Authentication for Critical Function vulnerability in Pharos Controls Mosaic Show Controller firmware version 2.15.3 could allow an unauthenticated attacker to bypass authentication and execute arbitrary commands with root privileges...

CVE-2026-2417

A Missing Authentication for Critical Function vulnerability in Pharos Controls Mosaic Show Controller firmware version 2.15.3 could allow an unauthenticated attacker to bypass authentication and execute arbitrary commands with root privileges...

EUVD-2018-4879

Malware in sbrugna...

Pharos Controls Device Information Disclosure Vulnerability

Pharos Controls devices is a lighting control device from Pharos Architectural Controls, UK. A security vulnerability exists in Pharos Controls devices. A remote attacker can exploit this vulnerability by sending a direct request to the default/index.lsp or default/log.lsp URIs to obtain sensitiv...

CVE-2018-12926

Pharos Controls devices allow remote attackers to obtain potentially sensitive information via a direct request for the default/index.lsp or default/log.lsp URI...

Information disclosure

Pharos Controls devices allow remote attackers to obtain potentially sensitive information via a direct request for the default/index.lsp or default/log.lsp URI...

CVE-2018-12926

Pharos Controls devices are affected by a remote information-disclosure vulnerability. An attacker can retrieve potentially sensitive data by issuing a direct request to the default/index.lsp or default/log.lsp URIs. The available sources describe this as an information-disclosure issue affecting...

CVE-2018-12926

Pharos Controls devices allow remote attackers to obtain potentially sensitive information via a direct request for the default/index.lsp or default/log.lsp URI...