Which versions of DMS+ are affected by CVE-2026-18452?

Rich Source DMS+ (Non-Mobile) contains a critical flaw allowing unauthenticated remote attackers to achieve complete device takeover via a hard-coded API key present across all deployments.

How to fix or mitigate CVE-2026-18452?

Within 24 hours, inventory all Rich Source DMS+ (Non-Mobile) installations and implement network segmentation to restrict direct access to management interfaces-disable external routing to DMS+ API endpoints and apply firewall rules limiting access to trusted administrative networks only. Within 7 days, contact Rich Source vendor support to request an emergency patch or validated workaround, and implement comprehensive API access logging and monitoring for unauthorized authentication attempts. Within 30 days, deploy any vendor-provided patch or compensating controls across all DMS+ instances, conduct forensic review of all DMS+ audit logs for evidence of unauthorized access or compromise, and evaluate migration to alternative solutions if the vendor cannot provide timely mitigation.

DMS+ CVE-2026-18452

Q: What is the CVSS score of CVE-2026-18452?

CVE-2026-18452 has a CVSS 4.0 base score of 10.0 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-51406 CRITICAL

Use of Hard-coded Credentials (CWE-798)

2026-07-31 twcert

GHSA-mpmj-35xj-3r38

Authentication Bypass Dms Non Mobile

10.0

CVSS 4.0 · Vendor: twcert

Severity by source

Vendor (twcert) PRIMARY

10.0 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

10.0 CRITICAL

Unauthenticated network access via a shared hard-coded key (PR:N, AC:L) yields full control of all managed devices, so scope changes (S:C) with High C/I/A.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (twcert).

CVSS VectorVendor: twcert

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 31, 2026 - 06:50 vuln.today

CVE Published

Jul 31, 2026 - 05:54 cve.org

CRITICAL 10.0

DescriptionCVE.org

DMS+ (Non-Mobile) developed by Rich Source has a Use of Hard-coded Credentials vulnerability. Unauthenticated remote attackers can exploit a fixed API key to gain control over all installed DMS+ devices.

AnalysisAI

Full device takeover in Rich Source DMS+ (Non-Mobile) is possible because the product ships with a hard-coded API key that is identical across all deployments. Unauthenticated remote attackers who obtain or extract this fixed key can authenticate to the management interface and seize control of every installed DMS+ device, with maximal confidentiality, integrity, and availability impact (CVSS 4.0 base 10.0). There is no public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.

Technical ContextAI

The vulnerability class is CWE-798 (Use of Hard-coded Credentials): a secret - here an API key used to authenticate API requests - is embedded directly in the shipped firmware or software rather than being generated per-installation or provisioned by the operator. Because the same key is reused across all DMS+ (Non-Mobile) instances (CPE cpe:2.3:a:rich_source:dms+_(non-mobile):*), recovering it once from one device, firmware image, or client binary yields access to all of them. DMS+ is a device management system marketed by the Taiwanese vendor Rich Source; the affected component is the API layer that mediates control commands to managed devices, which the fixed key is meant to protect but effectively does not.

RemediationAI

Apply the vendor-supplied update from Rich Source that removes the hard-coded API key and replaces it with per-installation, operator-provisioned credentials; consult the TWCERT/CC advisories at https://www.twcert.org.tw/en/cp-139-11073-de184-2.html and https://www.twcert.org.tw/tw/cp-132-11072-3a4d4-1.html for the specific fixed build, as no exact patched version number was provided in the input (no vendor-released patch version is independently confirmed here). Until a fix is confirmed installed, restrict network reachability of the DMS+ management/API interface by placing it behind a firewall or VPN and blocking external access to its service port, which limits exposure to trusted internal hosts at the cost of remote-management convenience; where the platform allows, rotate or override the API key to a unique value and monitor API authentication logs for use of the default key, accepting that a truly hard-coded key may not be changeable without the vendor patch. Segment DMS+ devices onto an isolated management VLAN to contain lateral movement if the key is abused.