{"id":"CVE-2026-121817","title":"About Time Technologies｜Herowatch Go Server - Insecure Direct Object Reference","summary":"Herowatch Go Server developed by About Time Technologies has a Insecure Direct Object Reference vulnerability. Authenticated remote attackers can modify specific parameters to access or operate other users' data and functions.","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cvssSource":"cna","cwe":["CWE-639"],"vendor":"About Time Technologies","product":"Herowatch Go Server","affected":["herowatch_go_server all"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-11-04T18:28:23.982957Z"},"published":"2026-11-04","updated":"2026-11-04","sourceUpdated":"2026-11-04T20:00:58.689Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-121817","references":[{"url":"https://www.twcert.org.tw/en/cp-139-11364-0dce6-2.html"},{"url":"https://www.twcert.org.tw/tw/cp-132-11366-d92ac-1.html"}],"tags":["cve.org"],"epss":0.00443,"epssPercentile":0.3876,"ingestedAt":"2026-11-05T21:36:00.526Z","slug":"CVE-2026-121817","body":"## Overview\n\nHerowatch Go Server developed by About Time Technologies has a Insecure Direct Object Reference vulnerability. Authenticated remote attackers can modify specific parameters to access or operate other users' data and functions.\n\n## Affected\n\n- `herowatch_go_server all`\n\n## Remediation\n\nThe product is no longer maintained. Users are advised to replace it with a supported device.","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}