Anritsu tells spectrum monitor owners to fence the device instead of fixing it

CWE-306 is the label CISA attached, and it is the operative detail ^[4]. Missing authentication for a critical function means the device has no credential at all, not merely a weak default one. Any host that can route a packet to the management interface is that monitor's administrator ^[2].

CISA's impact language covers three actions: altering operational settings, obtaining sensitive signal data, and disrupting device availability ^[8]. The middle one is the collection risk, and the advisory lists Communications, Defense Industrial Base, Emergency Services and Transportation Systems as the sectors running these boxes, deployed worldwide ^[9]. The first is the integrity risk. A monitor whose settings a stranger can change produces a record nobody can rely on afterwards. Because no authentication exists, there is also no failed login to alert on, so detection falls entirely to network telemetry around the device ^[15].

There is no fix to apply. Four models are listed, every version of each, and Anritsu says it has no plans to fix the issue, which leaves zero fixed versions to deploy ^[1][3][13]. The vendor's own guidance is to run the monitors inside secure network environments ^[3]. CISA's list is the familiar one: keep the devices off the internet, put them behind firewalls isolated from business networks, and use a VPN when remote access is required, with the caveat that a VPN is only as secure as the devices connected to it ^[12].

One thing to pin down before drawing that diagram. The advisory's vulnerability description names only the MS27102A, while the affected products list carries all four model numbers at all versions ^[6]. Anritsu's technical support line, published in the advisory, is where that gets settled ^[5].

No public exploitation specifically targeting CVE-2026-3356 had been reported to CISA at the time of the initial release ^[11], and Souvik Kandar, credited in the acknowledgments, reported the finding to CISA ^[10]. The advisory as published also carries no CVSS score in its metrics section ^[14]. Neither absence changes the exploitability picture: reachability alone is the whole chain. What counts is how many of these monitors can currently be reached from a business network or the open internet.