Vulnerability in Pharos Controls Mosaic Show Controller

The Flaw

Pharos Controls has identified a critical vulnerability in its Mosaic Show Controller firmware version 2.15.3, designated as CVE-2026-2417. This flaw arises from a missing authentication for critical functions, enabling unauthenticated attackers to execute arbitrary commands with root privileges. This means that anyone with malicious intent could potentially gain full control over the affected systems without needing any credentials.

The vulnerability has a CVSS score of 9.8, indicating its severity. Such a high score signifies that the flaw poses a significant risk to users, especially in critical infrastructure sectors like commercial facilities where these controllers are deployed.

What's at Risk

The Mosaic Show Controller is widely used in various commercial settings worldwide. Given its role in managing lighting and other technical aspects of shows and events, the implications of this vulnerability are far-reaching. If exploited, attackers could disrupt operations, manipulate settings, or even cause physical damage in environments relying on these systems.

Organizations using this firmware must assess their risk exposure immediately. The potential for unauthorized access to critical systems can lead to not only operational disruptions but also financial losses and damage to reputation.

Patch Status

Pharos Controls has recommended that users upgrade their Mosaic Show Controller to version 2.16 or later to mitigate this vulnerability. This patch addresses the authentication flaw, restoring the necessary security measures to protect against unauthorized access. Organizations should prioritize this upgrade, as failure to do so leaves them vulnerable to exploitation.

CISA (Cybersecurity and Infrastructure Security Agency) has also issued guidance on minimizing network exposure for control system devices. This includes locating control systems behind firewalls and ensuring they are not directly accessible from the internet.

Immediate Actions

Organizations should act swiftly to protect their systems. Here are key steps to take:

• Upgrade to the latest firmware: Ensure all Mosaic Show Controllers are updated to version 2.16 or higher.
• Minimize network exposure: Limit access to control systems and use firewalls to isolate them from the internet.
• Implement secure remote access: If remote access is necessary, utilize secure methods like VPNs and ensure they are regularly updated.

Additionally, organizations should conduct a thorough risk assessment and impact analysis to understand the potential consequences of this vulnerability. By taking these proactive measures, businesses can significantly reduce their risk and enhance their overall cybersecurity posture.