CVE-2023-5881 is a high severity (CVSS 8.2) missing authentication flaw on the Genie Aladdin Connect retrofit kit, model ALDCM. Anyone on the same local network could open the setup page and change the door controller's Wi-Fi settings. Genie says software version 14.1.1 fixes it and was pushed to online devices by December 2023.
What's affected
- Product: Genie Company Aladdin Connect garage door opener retrofit kit, model ALDCM.
- Affected: versions before the vendor fix. The NVD record gives no version range.
- Fixed: software version 14.1.1, which Genie says was automatically applied to all online devices as of December 2023. Genie asks owners to contact customer service to confirm their device has it.
- Severity: 8.2 High in the NVD record. Genie calls the impact very low because the attacker must already be on the same local network and the page is not reachable from the internet.
How to check if you're exposed
Ask Genie customer service to confirm that your device runs software 14.1.1 or later, as the vendor suggests. The Rapid7 write-up does not describe a way to read the version yourself.
Also check the network side. The device should sit on a network you control. From another device on that network, confirm that nothing outside your home or office can reach it, and that the router does not forward port 80 to the kit. Most home routers forward nothing by default, but forwarded ports are easy to forget.
What to do now
- Confirm with Genie customer service that the device runs software 14.1.1 or later.
- Make sure the kit is attached only to a network you own and control.
- Do not forward any router ports to the device, and keep it off guest networks shared with strangers.
- Use the mobile app for any setup or reconfiguration.
- If you run an office or building with many devices, put IoT hardware on its own network segment.
Why it matters
The setup page on TCP port 80 did not ask for a login. The record lists CWE-306, missing authentication for a critical function. The function in question is changing which Wi-Fi network the controller joins, which can cut the device off from its owner. Rapid7 shows the page can be reached by anyone who has network access to the kit.
Genie argues that the device can only be claimed by the owner in the mobile app, so a changed SSID does not give control of the door. That limits the damage and explains the vendor's low impact view, while the NVD score reflects the unauthenticated access itself. The practical fix is already in place for online devices. The record does not list this CVE as known exploited.
Quick check
My device is offline. Is it still vulnerable?
Genie says the fix was applied automatically to online devices. A device that has been offline may not have it, so contact customer service to confirm.
Sources
Last reviewed: 19 October 2026.
