Draft · INC-20261111-EF2C · Kestrel Systems GmbH (Demo)

Built from the incident record, under headings that follow what the provision asks for. Yours to check, complete and send through the authority's own form or portal; Cyresora files nothing.

2 items to complete — the record does not hold the threat type or root cause; the cross-border impact (the record says it is capable of one). Each is marked [to complete: …] in the text.

Final report — INC-20261111-EF2C — Exploited authentication bypass in the gateway management interface

DRAFT: Final report under NIS2 — significant incident
Directive (EU) 2022/2555, Article 23, Article 23(4)(d).
Prepared by Cyresora from incident INC-20261111-EF2C. Yours to check and edit before you send it; Cyresora files nothing.

To: BSI (national CSIRT)

1. Reporting organization
Kestrel Systems GmbH (Demo)
Contact: security@kestrel.example

2. Incident
Exploited authentication bypass in the gateway management interface
Our reference: INC-20261111-EF2C
Became aware: 2026-11-11 18:37:02 UTC (2026-11-11 19:37 CET)
Severity (our assessment): critical

3. Detailed description, including severity and impact (Article 23(4)(d))
A customer reported unauthorized configuration changes. Log review confirms an unauthenticated request path reaching the management API on firmware 4.2.0 and 4.2.1, and confirms it has been used against at least two customer deployments.
Severity: critical

4. Type of threat or root cause likely to have triggered it (Article 23(4)(d))
[to complete: the threat type or root cause]

5. Applied and ongoing mitigation measures (Article 23(4)(d))
Firmware 4.2.2 published to the update channel.

6. Cross-border impact, where applicable (Article 23(4)(d))
[to complete: the cross-border impact (the record says it is capable of one)]

7. Earlier submissions under this regime
Early warning: submitted 2026-11-12 13:37:02 UTC, their reference BSI-INC-88213

When you have sent it

Record it here with what you actually sent (edit the text above to match). That record stops this stage's clock.

Submitted at (Europe/Berlin)

Channel

Their reference

Draft: Final report

Final report — INC-20261111-EF2C — Exploited authentication bypass in the gateway management interface

When you have sent it