Diem CMS CVE-2026-112030

Exploitation requires a Diem CMS deployment (≤ 5.1.3) where the default password provisioned by the dmCorePlugin/lib/data/dmDataLoad.php data-loading logic was never changed by the operator - i.e., a default or unhardened configuration. The primary limiting factor is this configuration dependency: installations where administrators rotated the default credential are not exploitable. No user interaction is required and the instance must be network-reachable; because the credential is publicly known via the POC/issue, no legitimate prior account is needed in practice. Remediation is operator-side configuration (changing the default password), as no vendor patch has been confirmed.

This is a low-to-moderate priority issue despite being remotely reachable. The input CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) with all-Low impacts (VC:L/VI:L/VA:L) yields only 5.3, and the E:P (Proof-of-Concept) exploit maturity aligns with the reported public POC rather than active, weaponized use. There is no CISA KEV listing and no EPSS score was provided, so there is no signal of widespread or automated exploitation - consistent with an obscure product. The weakness (CWE-1393, Use of Default Password) is real but conditional: it only matters where an operator deployed Diem without changing the shipped/default credential, so the practical attack surface is limited to misconfigured or default installations. One notable tension: the input vector uses PR:L, yet exploitation of a publicly-known default password typically requires NO prior privileges (the attacker simply presents the known credential), which would argue for PR:N - this is a judgment discrepancy worth verifying, not a confirmed fact. Net: a legitimate hardening/configuration issue, not an urgent widespread-exploitation emergency.

An attacker enumerates an internet-facing Diem CMS instance and attempts to authenticate using the default credential shipped via the dmDataLoad.php data-loading routine. On a deployment where the default password was never changed, the attacker gains the associated account's limited access without needing valid prior credentials. A public POC/issue report exists (GitHub issue #453), lowering the effort to reproduce.