EUVD-2026-97137
GHSA-68rx-43cf-mfgv
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDiscover exposed Amnezia Web Panel
-
ExploitLog in with default credentials
-
ExecutionReach Backup Download in app.py
-
ImpactExfiltrate backup archive contents
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Default credential prevention
|
| Exploitation Conditions | Requires that the Amnezia Web Panel instance be network-reachable and that its default credentials remain unchanged - the vulnerability is the shipped/default credential set guarding the Backup Download feature in app.py (CWE-1392). Concretely, an attacker must reach the web panel and the Backup Download endpoint, then authenticate with the product's known default credentials to download backup data. Primary limiting factor: if an administrator has changed the default credentials, this path is closed; exposure is further limited where the panel is not reachable from untrusted networks. No user interaction and no legitimately-provisioned account are needed (PR:N), consistent with reliance on publicly-known defaults. |
| Impact | Signals are moderate and partially incomplete. The vendor/VulDB CVSS 4.0 base score is 6.9 (Medium) with vector AV:N/AC:L/AT:N/PR:N/UI:N and low impact across VC/VI/VA, and the exploit maturity metric E:P explicitly reflects a proof-of-concept rather than confirmed active exploitation. A public exploit exists (GitHub issue referenced), which raises practical risk, but there is NO CISA KEV listing and NO EPSS score provided in the input, so widespread or automated exploitation cannot be asserted. The PR:N rating is consistent with the root cause (CWE-1392, use of default credentials): no legitimately-obtained privileges are required because the attacker leverages publicly-known default credentials. Net assessment: this is a real, low-complexity, network-reachable weakness with a public PoC, but the limited per-impact scoring (all Low) and the niche footprint of the product keep it below the priority of ubiquitous-software criticals. It warrants prompt remediation where the panel is internet-exposed, but it is not a high-urgency mass-exploitation threat on current evidence. Conflicts/gaps: EPSS is absent (cannot gauge exploitation probability quantitatively), and the vendor did not respond, so there is no authoritative patch confirmation. |
| Exploit ScenarioDerived | An attacker locates an internet-exposed Amnezia Web Panel instance (versions up to 1.6.2/1.7.2) and authenticates using the product's unchanged default credentials. They then reach the Backup Download functionality in app.py and retrieve backup archives, disclosing sensitive configuration data. A public proof-of-concept for this issue has been disclosed (referenced GitHub issue), lowering the barrier to exploitation given the low attack complexity (AC:L) and lack of required user interaction. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 12, 2026
Use of default credentials in the PRVTPRO Amnezia Web Panel Backup Download feature (app.py) allows remote attackers to log in with the product's shipped default credential set and download backup data, exposing configuration and any secrets contained in those backups. Affected versions are through 1.6.2 and 1.7.2; publicly available exploit code exists, while there is no confirmed active exploitation (the CVE is not listed in CISA KEV). The CVSS v4.0 score is 6.9 with a vector of AV:N/AC:L/AT:N/PR:N/UI:N and low confidentiality/integrity/availability impact, and the independent assessment agrees the path is remotely reachable with no user interaction and no legitimately provisioned account, limited primarily by whether the default credentials have been changed and whether the panel is reachable from untrusted networks.
RemediationAI
No vendor-released patch was identified at time of analysis: the vendor was contacted about this disclosure and did not respond, so there is no fixed version to upgrade to and remediation must be compensating. The highest-value action is to replace the shipped default credentials with strong, unique ones on every Amnezia Web Panel instance and to audit for accounts still using defaults; the trade-off is that automated provisioning or integrations relying on the default login must be updated at the same time or they will break. Second, restrict network reachability of the panel and especially the Backup Download endpoint so it is not exposed to untrusted networks: place it behind a VPN, an SSH tunnel, or a reverse proxy that enforces its own authentication and IP allowlisting, accepting the operational cost of administrators needing an extra hop. Third, if backups are not required through the web interface, block or disable access to the Backup Download route in app.py at the proxy or application level, understanding that legitimate administrators then need an out-of-band backup procedure. Finally, treat any deployment that may have been accessed with default credentials as compromised: review panel and web server logs for requests to the backup endpoint, rotate every credential, key and VPN profile that could have been included in a downloaded backup, and monitor for follow-on use of those secrets, since the public exploit code at https://github.com/ASantsSec/CVE/issues/27 makes opportunistic scanning likely even without confirmed in-the-wild exploitation.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause class is CWE-1392 (Use of Default Credentials): the web panel ships with a default credential set that guards the Backup Download component implemented in app.py, the entry point of what appears to be a Python web application. Because the credentials are publicly known and unchanged on default deployments, the authentication step provides no real protection, so the weakness reduces to an access-control failure on the backup retrieval function rather than a code-injection or memory-safety bug. The CVSS v4.0 vector AV:N/AC:L/AT:N/PR:N/UI:N confirms network reachability, no attack preconditions beyond default configuration, no privileges required and no user interaction, with low impact to confidentiality, integrity and availability and E:P reflecting the public exploit. The tagged information-disclosure classification is consistent with the retrieved backup archive being the primary asset at risk; such archives commonly include panel configuration, service credentials, and VPN-related keys or profiles, which can enable lateral movement beyond the panel itself. The CPE cpe:2.3:a:prvtpro:amnezia-web-panel:*:*:*:*:*:*:*:* marks all versions of the package as in scope, matching the reported boundaries of 1.6.2 and 1.7.2, and no upstream fix has been published because the vendor did not respond to the disclosure.
Know when Amnezia Web Panel gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Network-reachable with low complexity and no legitimate privileges (PR:N) because exploitation uses publicly-known default credentials; impacts kept Low as backup disclosure yields limited, bounded compromise.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
2DescriptionCVE.org
A security vulnerability has been detected in PRVTPRO Amnezia-Web-Panel up to 1.6.2/1.7.2. This affects an unknown part of the file app.py of the component Backup Download. The manipulation leads to use of default credentials. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB