CFSE Consequence Paths Registryhttps://paths.cfse.ai/Cyber-physical consequence scoring for authority, perception, physical/safety, systemic reach, and recovery burden.CPATH-2026-0034 · August Smart Lock Pro + Connect Wi-Fi password disclosure via hardcoded key (CVE-2019-17098)https://paths.cfse.ai/CPATH-2026-0034https://paths.cfse.ai/CPATH-2026-0034Wed, 03 Jun 2026 00:00:00 GMTCandidate Paths band HIGH; dominant consequence Data privacy. This path is explicitly dominant because it reaches the record's highest candidate band, HIGH. Published baseline 6.5 MEDIUM.CPATH-2026-0040 · B. Braun Infusomat/Perfusor Space (SpaceCom2 / Battery pack SP with Wi-Fi) - remote unauthenticated dose alterationhttps://paths.cfse.ai/CPATH-2026-0040https://paths.cfse.ai/CPATH-2026-0040Wed, 03 Jun 2026 00:00:00 GMTCandidate Paths band CRITICAL; co-dominant consequences Device-control safety and Data privacy. These paths are co-dominant because each reaches the record's highest candidate band, CRITICAL; no array-order tie-break is applied. Published baseline 10 CRITICAL.CPATH-2026-0005 · Baxter Life2000 hard-coded clinician credentialshttps://paths.cfse.ai/CPATH-2026-0005https://paths.cfse.ai/CPATH-2026-0005Wed, 03 Jun 2026 00:00:00 GMTCandidate Paths band CRITICAL; dominant consequence Account authority. This path is explicitly dominant because it reaches the record's highest candidate band, CRITICAL. Published baseline 9.3 CRITICAL.CPATH-2026-0002 · Baxter Life2000 — insufficient audit logginghttps://paths.cfse.ai/CPATH-2026-0002https://paths.cfse.ai/CPATH-2026-0002Wed, 03 Jun 2026 00:00:00 GMTCandidate Paths band MONITOR; dominant consequence Observability and recovery. Observability and recovery is the only modeled consequence because insufficient logging creates no independent exploit primitive or reachable authority; MONITOR is therefore explicit, not an array-order default. Published baseline 10 CRITICAL.CPATH-2026-0004 · Baxter Life2000 internal JTAG flash R/Whttps://paths.cfse.ai/CPATH-2026-0004https://paths.cfse.ai/CPATH-2026-0004Wed, 03 Jun 2026 00:00:00 GMTCandidate Paths band CRITICAL; co-dominant consequences Device-control safety and Firmware trust root. These paths are co-dominant because each reaches the record's highest candidate band, CRITICAL; no array-order tie-break is applied. Published baseline 9.3 CRITICAL.CPATH-2026-0039 · Baxter Sigma Spectrum WBM - cleartext Wi-Fi credentials and PHIhttps://paths.cfse.ai/CPATH-2026-0039https://paths.cfse.ai/CPATH-2026-0039Wed, 03 Jun 2026 00:00:00 GMTCandidate Paths band HIGH; co-dominant consequences Account authority and Data privacy. These paths are co-dominant because each reaches the record's highest candidate band, HIGH; no array-order tie-break is applied. Published baseline 4.2 MEDIUM.CPATH-2026-0033 · Chirp Systems / Chirp Access smart-lock app hardcoded credentials (CVE-2024-2197)https://paths.cfse.ai/CPATH-2026-0033https://paths.cfse.ai/CPATH-2026-0033Wed, 03 Jun 2026 00:00:00 GMTCandidate Paths band HIGH; co-dominant consequences Account authority and Device-control safety. These paths are co-dominant because each reaches the record's highest candidate band, HIGH; no array-order tie-break is applied. Published baseline 4.3 MEDIUM.CPATH-2026-0003 · Contec CMS8000 — unsigned-firmware load / hard-coded beaconhttps://paths.cfse.ai/CPATH-2026-0003https://paths.cfse.ai/CPATH-2026-0003Wed, 03 Jun 2026 00:00:00 GMTCandidate Paths band CRITICAL; co-dominant consequences Firmware trust root and Device-control safety and Data privacy. These paths are co-dominant because each reaches the record's highest candidate band, CRITICAL; no array-order tie-break is applied. Published baseline 8.2 HIGH.CPATH-2026-0006 · Contec CMS8000 out-of-bounds write via UDPhttps://paths.cfse.ai/CPATH-2026-0006https://paths.cfse.ai/CPATH-2026-0006Wed, 03 Jun 2026 00:00:00 GMTCandidate Paths band EMERGENCY; co-dominant consequences Device-control safety and Device availability and recovery. These paths are co-dominant because each reaches the record's highest candidate band, EMERGENCY; no array-order tie-break is applied. Published baseline 9.8 CRITICAL.CPATH-2026-0030 · Dahua IP camera / VTH / VTO authentication bypass (CVE-2021-33044)https://paths.cfse.ai/CPATH-2026-0030https://paths.cfse.ai/CPATH-2026-0030Wed, 03 Jun 2026 00:00:00 GMTCandidate Paths band EMERGENCY; co-dominant consequences Device-control safety and Account authority. These paths are co-dominant because each reaches the record's highest candidate band, EMERGENCY; no array-order tie-break is applied. Published baseline 9.8 CRITICAL.CPATH-2026-0020 · DJI Mavic 3 Wi-Fi Weak Credentials / QuickTransfer Key Derivation (CVE-2023-6951)https://paths.cfse.ai/CPATH-2026-0020https://paths.cfse.ai/CPATH-2026-0020Wed, 03 Jun 2026 00:00:00 GMTCandidate Paths band CRITICAL; dominant consequence Perception privacy. This path is explicitly dominant because it reaches the record's highest candidate band, CRITICAL. Published baseline 6.6 MEDIUM.CPATH-2026-0016 · Face-Mic: zero-permission motion-sensor speech and speaker-identity eavesdropping on AR/VR headsets (Rutgers/NJIT, 2021)https://paths.cfse.ai/CPATH-2026-0016https://paths.cfse.ai/CPATH-2026-0016Wed, 03 Jun 2026 00:00:00 GMTCandidate Paths band CRITICAL; dominant consequence Perception privacy. This path is explicitly dominant because it reaches the record's highest candidate band, CRITICAL. No published baseline.CPATH-2026-0013 · GAZEploit: keystroke inference from Vision Pro Persona eye movements (CVE-2024-40865)https://paths.cfse.ai/CPATH-2026-0013https://paths.cfse.ai/CPATH-2026-0013Wed, 03 Jun 2026 00:00:00 GMTCandidate Paths band CRITICAL; co-dominant consequences Perception privacy and Account authority. The privacy and account paths are co-dominant at CRITICAL because one outward Persona channel can disclose typed content and, conditionally, credentials that cross into account authority; neither is selected by array order. Published baseline 5.3 MEDIUM.CPATH-2026-0038 · GE CARESCAPE / ApexPro patient monitoring (MDhex) - exposed shared SSH private keyhttps://paths.cfse.ai/CPATH-2026-0038https://paths.cfse.ai/CPATH-2026-0038Wed, 03 Jun 2026 00:00:00 GMTCandidate Paths band EMERGENCY; co-dominant consequences Perception-to-action and Device-control safety. These paths are co-dominant because each reaches the record's highest candidate band, EMERGENCY; no array-order tie-break is applied. Published baseline 10 CRITICAL.CPATH-2026-0022 · GPS/GNSS Spoofing Safe-Hijacking of Consumer Drones (Adaptive GPS Spoofing / Tractor Beam class)https://paths.cfse.ai/CPATH-2026-0022https://paths.cfse.ai/CPATH-2026-0022Wed, 03 Jun 2026 00:00:00 GMTCandidate Paths band CRITICAL; co-dominant consequences Perception-to-action and Device-control safety. These paths are co-dominant because each reaches the record's highest candidate band, CRITICAL; no array-order tie-break is applied. No published baseline.CPATH-2026-0029 · Hikvision IP camera / NVR unauthenticated command injection (CVE-2021-36260)https://paths.cfse.ai/CPATH-2026-0029https://paths.cfse.ai/CPATH-2026-0029Wed, 03 Jun 2026 00:00:00 GMTCandidate Paths band EMERGENCY; co-dominant consequences Perception-to-action and Account authority and Fleet control plane. These paths are co-dominant because each reaches the record's highest candidate band, EMERGENCY; no array-order tie-break is applied. Published baseline 9.8 CRITICAL.CPATH-2026-0014 · HoloLens Broadcom Wi-Fi over-the-air RCE/DoS (ADV190017: CVE-2019-9501/9503)https://paths.cfse.ai/CPATH-2026-0014https://paths.cfse.ai/CPATH-2026-0014Wed, 03 Jun 2026 00:00:00 GMTCandidate Paths band CRITICAL; dominant consequence Device-control safety. This path is explicitly dominant because it reaches the record's highest candidate band, CRITICAL. Published baseline 8.8 HIGH.CPATH-2026-0015 · HoloLens Device Portal pairing-API unauthenticated DoS (CVE-2024-57972)https://paths.cfse.ai/CPATH-2026-0015https://paths.cfse.ai/CPATH-2026-0015Wed, 03 Jun 2026 00:00:00 GMTCandidate Paths band CRITICAL; dominant consequence Device availability and recovery. This path is explicitly dominant because it reaches the record's highest candidate band, CRITICAL. Published baseline 6.5 MEDIUM.CPATH-2026-0012 · Inception Attack: malicious VR app hijacks the entire Meta Quest environment (UChicago, 2024)https://paths.cfse.ai/CPATH-2026-0012https://paths.cfse.ai/CPATH-2026-0012Wed, 03 Jun 2026 00:00:00 GMTCandidate Paths band CRITICAL; co-dominant consequences Perception-to-action and Perception privacy. These paths are co-dominant because each reaches the record's highest candidate band, CRITICAL; no array-order tie-break is applied. No published baseline.CPATH-2026-0035 · Medtronic Conexus RF telemetry protocol lacks authentication/encryption (implantable cardiac devices)https://paths.cfse.ai/CPATH-2026-0035https://paths.cfse.ai/CPATH-2026-0035Wed, 03 Jun 2026 00:00:00 GMTCandidate Paths band CRITICAL; co-dominant consequences Device-control safety and Data privacy. These paths are co-dominant because each reaches the record's highest candidate band, CRITICAL; no array-order tie-break is applied. Published baseline 9.3 CRITICAL.CPATH-2026-0036 · Medtronic MiniMed 508 / Paradigm insulin pumps - unauthenticated RF allows insulin delivery controlhttps://paths.cfse.ai/CPATH-2026-0036https://paths.cfse.ai/CPATH-2026-0036Wed, 03 Jun 2026 00:00:00 GMTCandidate Paths band CRITICAL; co-dominant consequences Device-control safety and Data privacy. These paths are co-dominant because each reaches the record's highest candidate band, CRITICAL; no array-order tie-break is applied. Published baseline 8.8 HIGH.CPATH-2026-0037 · Medtronic MiniMed / NGP 600 series insulin pumps - RF pairing protocol allows bolus/delivery manipulationhttps://paths.cfse.ai/CPATH-2026-0037https://paths.cfse.ai/CPATH-2026-0037Wed, 03 Jun 2026 00:00:00 GMTCandidate Paths band CRITICAL; dominant consequence Device-control safety. This path is explicitly dominant because it reaches the record's highest candidate band, CRITICAL. Published baseline 4.8 MEDIUM.CPATH-2026-0032 · Moxa PT/EDS industrial Ethernet switch authentication bypass (CVE-2024-12297)https://paths.cfse.ai/CPATH-2026-0032https://paths.cfse.ai/CPATH-2026-0032Wed, 03 Jun 2026 00:00:00 GMTCandidate Paths band HIGH; co-dominant consequences Account authority and Device availability and recovery and Data privacy. These paths are co-dominant because each reaches the record's highest candidate band, HIGH; no array-order tie-break is applied. Published baseline 9.2 CRITICAL.CPATH-2026-0021 · Phantom of the ADAS: Projected/Billboard Phantom Object Attacks on Tesla Autopilot and Mobileyehttps://paths.cfse.ai/CPATH-2026-0021https://paths.cfse.ai/CPATH-2026-0021Wed, 03 Jun 2026 00:00:00 GMTCandidate Paths band CRITICAL; co-dominant consequences Device-control safety and Perception-to-action. These paths are co-dominant because each reaches the record's highest candidate band, CRITICAL; no array-order tie-break is applied. No published baseline.CPATH-2026-0017 · PX4 Autopilot MAVLink Unauthenticated Remote Shell (CVE-2026-1579)https://paths.cfse.ai/CPATH-2026-0017https://paths.cfse.ai/CPATH-2026-0017Wed, 03 Jun 2026 00:00:00 GMTCandidate Paths band EMERGENCY; dominant consequence Device-control safety. This path is explicitly dominant because it reaches the record's highest candidate band, EMERGENCY. Published baseline 9.8 CRITICAL.CPATH-2026-0001 · Qardio Arm — static credentials → engineering backdoorhttps://paths.cfse.ai/CPATH-2026-0001https://paths.cfse.ai/CPATH-2026-0001Wed, 03 Jun 2026 00:00:00 GMTCandidate Paths band CRITICAL; dominant consequence Account authority. This path is explicitly dominant because it reaches the record's highest candidate band, CRITICAL. Published baseline 6.6 MEDIUM.CPATH-2026-0007 · Qardio BLE unauthenticated DoS (startMeasurement flood)https://paths.cfse.ai/CPATH-2026-0007https://paths.cfse.ai/CPATH-2026-0007Wed, 03 Jun 2026 00:00:00 GMTCandidate Paths band ELEVATED; dominant consequence Device availability and recovery. This path is explicitly dominant because it reaches the record's highest candidate band, ELEVATED. Published baseline 7.1 HIGH.CPATH-2026-0008 · Qardio firmware files extractablehttps://paths.cfse.ai/CPATH-2026-0008https://paths.cfse.ai/CPATH-2026-0008Wed, 03 Jun 2026 00:00:00 GMTCandidate Paths band HIGH; dominant consequence Data privacy. This path is explicitly dominant because it reaches the record's highest candidate band, HIGH. Published baseline 6.9 MEDIUM.CPATH-2026-0011 · SideQuest deep-link one-click RCE on Oculus Quest sideloading platform (CVE-2024-21625)https://paths.cfse.ai/CPATH-2026-0011https://paths.cfse.ai/CPATH-2026-0011Wed, 03 Jun 2026 00:00:00 GMTCandidate Paths band CRITICAL; co-dominant consequences Perception-to-action and Account authority. These paths are co-dominant because each reaches the record's highest candidate band, CRITICAL; no array-order tie-break is applied. Published baseline 8.8 HIGH.CPATH-2026-0009 · Swisslog Translogic PTS unsigned firmware updatehttps://paths.cfse.ai/CPATH-2026-0009https://paths.cfse.ai/CPATH-2026-0009Wed, 03 Jun 2026 00:00:00 GMTCandidate Paths band EMERGENCY; co-dominant consequences Firmware trust root and Fleet control plane. These paths are co-dominant because each reaches the record's highest candidate band, EMERGENCY; no array-order tie-break is applied. Published baseline 9.8 CRITICAL.CPATH-2026-0010 · Swisslog Translogic TLP20 tcpTxThread stack overflowhttps://paths.cfse.ai/CPATH-2026-0010https://paths.cfse.ai/CPATH-2026-0010Wed, 03 Jun 2026 00:00:00 GMTCandidate Paths band CRITICAL; co-dominant consequences Device-control safety and Device availability and recovery. These paths are co-dominant because each reaches the record's highest candidate band, CRITICAL; no array-order tie-break is applied. Published baseline 9.8 CRITICAL.CPATH-2026-0028 · Teleoperated surgical robot (Raven II) command hijacking & E-stop abusehttps://paths.cfse.ai/CPATH-2026-0028https://paths.cfse.ai/CPATH-2026-0028Wed, 03 Jun 2026 00:00:00 GMTCandidate Paths band CRITICAL; co-dominant consequences Perception-to-action and Device-control safety and Device availability and recovery. These paths are co-dominant because each reaches the record's highest candidate band, CRITICAL; no array-order tie-break is applied. No published baseline.CPATH-2026-0019 · Tesla Model 3 Gateway Firmware Signature-Bypass / TOCTTOU Code Execution (CVE-2023-32156)https://paths.cfse.ai/CPATH-2026-0019https://paths.cfse.ai/CPATH-2026-0019Wed, 03 Jun 2026 00:00:00 GMTCandidate Paths band CRITICAL; co-dominant consequences Device-control safety and Firmware trust root. These paths are co-dominant because each reaches the record's highest candidate band, CRITICAL; no array-order tie-break is applied. Published baseline 9 CRITICAL.CPATH-2026-0018 · Tesla Model 3 VCSEC TPMS Integer Overflow RCE (CVE-2025-2082)https://paths.cfse.ai/CPATH-2026-0018https://paths.cfse.ai/CPATH-2026-0018Wed, 03 Jun 2026 00:00:00 GMTCandidate Paths band CRITICAL; dominant consequence Perception-to-action. This path is explicitly dominant because it reaches the record's highest candidate band, CRITICAL. Published baseline 7.5 HIGH.CPATH-2026-0031 · TP-Link Archer AX21 (AX1800) router unauthenticated command injection (CVE-2023-1389)https://paths.cfse.ai/CPATH-2026-0031https://paths.cfse.ai/CPATH-2026-0031Wed, 03 Jun 2026 00:00:00 GMTCandidate Paths band EMERGENCY; co-dominant consequences Account authority and Fleet control plane. These paths are co-dominant because each reaches the record's highest candidate band, EMERGENCY; no array-order tie-break is applied. Published baseline 8.8 HIGH.CPATH-2026-0026 · Unitree Go1 CloudSail undocumented remote-access backdoor (CVE-2025-2894)https://paths.cfse.ai/CPATH-2026-0026https://paths.cfse.ai/CPATH-2026-0026Wed, 03 Jun 2026 00:00:00 GMTCandidate Paths band EMERGENCY; co-dominant consequences Device-control safety and Fleet control plane. These paths are co-dominant because each reaches the record's highest candidate band, EMERGENCY; no array-order tie-break is applied. Published baseline 6.6 MEDIUM.CPATH-2026-0025 · Unitree Go2 Android-app database tampering RCE (CVE-2026-27510)https://paths.cfse.ai/CPATH-2026-0025https://paths.cfse.ai/CPATH-2026-0025Wed, 03 Jun 2026 00:00:00 GMTCandidate Paths band CRITICAL; dominant consequence Perception privacy. This path is explicitly dominant because it reaches the record's highest candidate band, CRITICAL. Published baseline 9.6 CRITICAL.CPATH-2026-0024 · Unitree Go2 unauthenticated DDS RCE via programming_actuator topic (CVE-2026-27509)https://paths.cfse.ai/CPATH-2026-0024https://paths.cfse.ai/CPATH-2026-0024Wed, 03 Jun 2026 00:00:00 GMTCandidate Paths band CRITICAL; co-dominant consequences Device-control safety and Perception privacy. These paths are co-dominant because each reaches the record's highest candidate band, CRITICAL; no array-order tie-break is applied. Published baseline 8.5 HIGH.CPATH-2026-0023 · Unitree UniPwn — BLE Wi-Fi config root takeover (Go2/B2/G1/H1)https://paths.cfse.ai/CPATH-2026-0023https://paths.cfse.ai/CPATH-2026-0023Wed, 03 Jun 2026 00:00:00 GMTCandidate Paths band EMERGENCY; dominant consequence Fleet control plane. The fleet-control-plane path is dominant because documented peer scanning can reuse the shared key across in-range robots, producing the only fleet-scale EMERGENCY path; motion and privacy remain supporting CRITICAL paths. Published baseline 8.2 HIGH.CPATH-2026-0027 · Universal Robots PolyScope 5 Dashboard Server OS command injection (CVE-2026-8153)https://paths.cfse.ai/CPATH-2026-0027https://paths.cfse.ai/CPATH-2026-0027Wed, 03 Jun 2026 00:00:00 GMTCandidate Paths band EMERGENCY; co-dominant consequences Device-control safety and Fleet control plane and Account authority. These paths are co-dominant because each reaches the record's highest candidate band, EMERGENCY; no array-order tie-break is applied. Published baseline 9.8 CRITICAL.