CVE-2026-25715
CRITICALCVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
2Description
The web management interface of the device allows the administrator username and password to be set to blank values. Once applied, the device permits authentication with empty credentials over the web management interface and Telnet service. This effectively disables authentication across all critical management channels, allowing any network-adjacent attacker to gain full administrative control without credentials.
Analysis
Blank admin credentials allowed in device web management. Admin can set empty password, making device fully accessible.
Sign in for full analysis, threat intelligence, and remediation guidance.
Remediation
Within 24 hours: Audit all affected devices to identify those with blank administrative credentials and immediately set strong passwords; disable Telnet service where possible and restrict web management interface access to trusted networks only. Within 7 days: Implement network segmentation to isolate management interfaces from untrusted networks; deploy monitoring and alerting for failed authentication attempts on all affected devices. …
Sign in for detailed remediation steps.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today