CISA 2026-08-25

PayRange API

CVE-2026-18965

Machine-generated analysis · WAYSCloud LLM

All versions of the PayRange API are missing proper authorization on management endpoints. This permits unauthenticated disclosure, modification, or denial-of-service of device data.

Context

The advisory concerns the PayRange API, which provides remote management functions for PayRange payment devices. The advisory states that missing authorization on its management endpoints allows anyone to retrieve detailed device information, modify device settings, or cause denial-of-service conditions. PayRange has not provided a remediation, and users are directed to contact the vendor’s support address for further information.

Operator considerations

Check: Verify the presence of any PayRange API instances, regardless of version.
Isolate: Restrict network access to PayRange API management endpoints to trusted hosts only.
Log: Monitor and alert on unexpected requests to PayRange API management URLs.

From Cybersecurity and Infrastructure Security Agency ↗

Successful exploitation of this vulnerability could allow a remote, authenticated or unauthenticated attacker to disclose sensitive information, arbitrarily modify the device to cause a denial of service, or alter a devices displayed image.

The following versions of PayRange API are affected:

PayRange API vers:all/*

Vendor

Equipment

PayRange

PayRange API

Missing Authorization

Critical Infrastructure Sectors: Commercial Facilities

Countries/Areas Deployed: United States, Canada

Company Headquarters Location: United States

The affected product is missing proper authorization on management endpoints, which allows verbose details of every device on the PayRange network to be publicly accessible, with or without an account.

PayRange API

MitigationPayRange has not responded to requests to work with CISA to mitigate this vulnerability. Users of PayRange devices are invited to co...

Read the full advisory on CISA →