A vulnerability in the ePati Antikor Next-Generation Firewall allows attackers to bypass authentication entirely and access sensitive system data through an unprotected WebSocket endpoint.
The flaw, tracked as CVE-2026-2624, affects firmware versions 2.0.1298 through 2.0.1301. The WebSocket endpoint used by the firewall’s SockJS-based real-time communication doesn’t properly verify authentication. An attacker can connect directly to the WebSocket URL with randomly generated server and session IDs — no credentials needed — and start issuing commands.
Once connected, the attacker can send requests to query cluster status, system information, and even capture network packet data. All of this happens without ever logging in. The vendor has released version 2.0.1302 to address the issue.
This is a textbook authentication bypass: the frontend enforces login, but the backend WebSocket endpoint doesn’t check whether the connecting session is actually authenticated. If you’re running an ePati Antikor NGFW, update to firmware 2.0.1302 immediately. In the meantime, restrict network access to the management interface (default port 8800) to trusted IPs only.
