EUVD-2026-69285
GHSA-93hw-xcq2-c2fw
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Network-reachable hard-coded credential needs no auth or interaction (AV:N/AC:L/PR:N/UI:N); described impact is sensitive-data retrieval only, so C:H but I:N/A:N.
Primary rating from Vendor (TR-CERT).
CVSS VectorVendor: TR-CERT
Lifecycle Timeline
2DescriptionCVE.org
Use of Hard-coded Credentials vulnerability in TMT Machine Industry and Trade Ltd. Co. Talassoft Industrial Management Software allows Retrieve Embedded Sensitive Data.
This issue affects Talassoft Industrial Management Software: from V.4 before V.16.
AnalysisAI
Sensitive data disclosure in TMT Machine Industry and Trade's Talassoft Industrial Management Software (versions V.4 through pre-V.16) stems from hard-coded credentials embedded in the application, allowing remote attackers to retrieve protected sensitive data without authentication. The flaw was reported by Turkey's national CERT (TR-CERT/USOM) and carries a CVSS 9.1 rating. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires network access to a Talassoft Industrial Management Software instance running a version in the V.4-to-pre-V.16 range, plus knowledge of the hard-coded credential embedded in the software. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) describes a network-reachable, low-complexity, unauthenticated attack with high confidentiality and integrity impact, yielding a 9.1 base score. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade Talassoft Industrial Management Software to V.16 or later, which is the first release outside the affected range per the version data (from V.4 before V.16); confirm the exact fixed build directly with TMT Machine Industry and Trade via the TR-CERT advisory at https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0965. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Conduct complete inventory of all Talassoft deployments, identify which systems run versions V.4 through pre-V.16, and document their network exposure and data sensitivity. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-798 – Use of Hard-coded Credentials
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today