What is the CVSS score of CVE-2026-25715?

CVE-2026-25715 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

How to fix or mitigate CVE-2026-25715?

Within 24 hours: Audit all affected devices to identify those with blank administrative credentials and immediately set strong passwords; disable Telnet service where possible and restrict web management interface access to trusted networks only. Within 7 days: Implement network segmentation to isolate management interfaces from untrusted networks; deploy monitoring and alerting for failed authentication attempts on all affected devices. Within 30 days: Evaluate vendor timeline for patch availability; consider device replacement or decommissioning if patch will not be available; conduct full access audit to confirm no unauthorized changes were made to affected devices.

CVE-2026-25715

CRITICAL

Weak Password Requirements (CWE-521)

2026-02-20 ics-cert@hq.dhs.gov

Information Disclosure

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:04 vuln.today

CVE Published

Feb 20, 2026 - 17:25 nvd

CRITICAL 9.8

DescriptionCVE.org

The web management interface of the device allows the administrator username and password to be set to blank values. Once applied, the device permits authentication with empty credentials over the web management interface and Telnet service. This effectively disables authentication across all critical management channels, allowing any network-adjacent attacker to gain full administrative control without credentials.