CVE-2026-24346 is a critical (CVSS 9.1) flaw in the admin web UI of the NimbleTech EZCast Pro II dongle, which accepts well-known default credentials. The Swiss NTC reports that no firmware patch is available. Disconnect the dongle from your network, use it only as an access point, and change the default password.
What's affected
The record names EZCast Pro II version 1.17478.146. The Swiss National Test Institute for Cybersecurity (NTC) lists the vulnerable version as all versions, with 1.17478.146 as the one it tested. Its status for the issue is pending, and it notes the vendor has not been able to provide patches.
NTC rates the criticality as medium, while the CVSS record scores it 9.1. The gap is a good reminder that a score does not know how your dongle is deployed.
How to check if you're exposed
Look for EZCast Pro II dongles in meeting rooms, labs and shared spaces, since they are easy to lose track of. For each one, check the firmware version in its admin interface and note whether it is connected to your local network or only acts as its own access point.
If you cannot reach the admin page with the factory credentials, that is a good sign. Do not try credentials against devices you do not own.
What to do now
- Disconnect the dongle from the local network, as NTC advises.
- Limit use strictly to access point functionality.
- Change the default password on the admin UI.
- Watch the NTC vulnerability hub and the vendor for a firmware patch.
- Where a device cannot be secured, retire it.
Why it matters
The weakness is CWE-798, use of hard-coded credentials. When every unit ships with a known password, anyone who can reach the admin page can log in, and the password cannot be treated as a secret. The record lists high impact for confidentiality and integrity.
NTC points to a warning from the Swiss National Cyber Security Centre and says it will not publish technical details. With no patch available, the mitigation is about reducing exposure. It is not in CISA's Known Exploited Vulnerabilities catalog.
Quick check
Is there a firmware fix?
The NTC page says the vendor has not yet been able to provide patches. Check the NTC hub for updates.
What is the safest short term step?
Take the dongle off the local network, use it only as an access point and change the default password.
Sources
Last reviewed: 19 October 2026.
