CVSS 10 'critical' bug hits a door intercom you've probably never heard of

A newly published vulnerability, CVE-2026-94493, has been rated the maximum possible 10 out of 10 on the CVSS severity scale. That number tends to grab headlines, so it’s worth being precise about what’s actually going on here - and, just as importantly, who this doesn’t affect.

What the bug actually does

The flaw sits in the firmware of the Gigatech PDV5701, a video door station (essentially a smart intercom unit) running software version 1.0.31_240305_112640. According to a report filed on GitHub, credited to researchers at Northwestern Polytechnical University’s School of Cyberspace Security, the device’s WebSocket management interface is missing basic authentication checks.

In plain terms: a key endpoint called /getparameter can reportedly be queried by anyone on the network, without logging in first. The same report lists a string of related endpoints - covering configuration, accounts, SIP server settings, community/access lists, firmware updates, file uploads, reboot commands and an “openbox” function - that appear to share the same problem. If accurate, that combination could let an attacker read sensitive configuration data and, more seriously, push changes that amount to taking full administrative control of the unit, including triggering a reboot or a firmware update remotely.

That’s a genuinely nasty vulnerability class for a networked door-entry device, which is presumably why it’s landed at the top of the CVSS scale on NVD’s listing.

So who is actually at risk

This is where the “critical” score needs some context. CVE-2026-94493 doesn’t affect a browser, an operating system or a piece of software installed on millions of ordinary PCs or phones. It affects one specific model of intercom hardware from a manufacturer, Gigatech, that most UK readers will never have encountered, running one particular firmware build.

Crucially, the source material we’ve seen doesn’t tell us how many of these units are actually deployed, whether they’re reachable from the open internet or only from a local network, whether Gigatech has issued a patch, or whether anyone has exploited the flaw in the wild. Those are exactly the questions the researchers’ own tracker flags as still open. A CVSS 10 score reflects how bad the bug would be if triggered under worst-case conditions - not how many people are exposed to it.

In practice, that means the realistic pool of affected people is: owners or installers of the PDV5701 unit specifically, and only if their device is accessible to an attacker in the first place. If you don’t run this hardware, none of this touches you.

What to do about it

If you are responsible for a Gigatech PDV5701 installation - likely a small number of businesses or apartment blocks using it as a door-entry system - the sensible steps are the standard ones: check with the vendor for a firmware update, and in the meantime make sure the device sits behind a firewall rather than facing the open internet, since the bug appears to require network access to the WebSocket interface. There’s no confirmed patch referenced in the current disclosures, so isolating the device is the practical mitigation until one appears.

For everyone else, this is a useful reminder that a scary CVSS score is a statement about severity, not spread. A flaw in one manufacturer’s door intercom firmware is a real problem for the people who own that intercom - and a non-event for almost everybody reading this.