CVE-2026-1364 Details
Description
IAQS and I6 developed by JNC has a Missing Authentication vulnerability, allowing unauthenticated remote attackers to directly operate system administrative functionalities.
A missing authentication vulnerability has been identified in JNC's IAQS and I6 products. This vulnerability allows unauthenticated remote attackers to directly access and operate system administrative functions. The issue arises from a lack of proper authentication mechanisms, enabling unauthorized users to manipulate administrative features remotely.
JNC has released a patch for devices using the M4 chip. However, devices with the M3 chip do not support the update and are recommended to be replaced. Users should contact the vendor to confirm which chip their device uses and take appropriate action.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jan 23, 2026CISA-ADP
Assessed Jan 23, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://www.twcert.org.tw/en/cp-139-10653-117a1-2.html | [email protected] | AdvisoryBundleRemedy |
| https://www.twcert.org.tw/tw/cp-132-10652-4cdca-1.html | [email protected] | AdvisoryBundleRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-306 | Missing Authentication for Critical Function | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| JNC IAQS | All versions |
CPE
Remediation
| |
| JNC I6 | All versions |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jan 23, 2026 | New CVE Received | [email protected] |