Itron MV-90 xi CVE-2026-103548

Requires local access to the host running Itron MV-90 xi 3.0 and the ability to read the application's configuration file - the CVSS vector is AV:L with PR:L, so a low-privileged local/authenticated account (or equivalent filesystem read access) is needed; there is no remote or unauthenticated path. Once the config file is obtained, no user interaction is required and the stored passwords and password histories can be decoded because they are kept in a recoverable format, yielding login as any application user. The limiting factors are the local vector and the need for prior access to the config file, making this an escalation/lateral-movement primitive rather than an initial-access flaw.

This is a credential-storage weakness (CWE-257) in Itron MV-90 xi, utility meter-data-collection software: passwords and password histories are stored in a recoverable/decodable form in the application config file, letting anyone who can read that file recover credentials and log in as any user, including privileged accounts. The vendor CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N) is local and low-privilege, and SSVC confirms this is not an urgent internet-facing threat: Exploitation=none (no observed exploitation), Automatable=no, Technical Impact=partial. The E:P flag in the vector plus the Palo Alto Unit 42 disclosure indicate proof-of-concept/exploit maturity exists, but there is no KEV listing and no EPSS score provided, consistent with a targeted, insider- or foothold-dependent issue rather than mass exploitation. Note a tension in the impact metrics: the vendor scored the vulnerable system as low impact (VC:L/VI:N/VA:L) yet marked full subsequent-system impact (SC:H/SI:H/SA:H) and the description says an attacker gains access 'as any user' - recovering all users' credentials is effectively full application account takeover, which I assess as higher confidentiality/integrity impact than the vendor's headline 5.3 suggests. The real limiting factor is the local, authenticated prerequisite (must already read the config file), so this is a privilege-escalation/lateral-movement enabler for an attacker who already has a foothold, not a remote entry point.

An attacker who already has a low-privileged account or filesystem access on the host running MV-90 xi 3.0 reads the application config file, extracts the stored (recoverable) password blobs and password histories, and decodes them offline. They then authenticate to the MV-90 application as any user - including administrators - to view or manipulate metering data. Palo Alto Unit 42 has published a disclosure (PANW-2026-0002) and the CVSS vector's E:P marking indicates proof-of-concept maturity, though no active exploitation is reported.