CVE-2014-7279

This vulnerability is like leaving a spare key under the doormat—except the key is for the plug’s control panel, and it can be used over the network. If someone can reach the plug’s Telnet login port, they may be able to switch it on/off, change management settings, and potentially interfere with your environment remotely.

This matters if your business uses Konke Smart Plug K devices and Telnet is enabled and reachable on TCP port 23. It’s only a risk when an attacker can reach that port on your network (especially from the internet) because there is no login required. If Telnet is disabled or port 23 is not reachable from the outside, the risk is greatly reduced.

Treat this as urgent because attackers can take full administrative control without any password, and the flaw is reachable in default configuration when Telnet is enabled. Even though CISA KEV does not list it and press attention is rising, there is a public exploit available, so you should act now to remove network access to Telnet and/or replace affected plugs.