What is the CVSS score of CVE-2026-35905?

CVE-2026-35905 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of T3 Technology CPE are affected by CVE-2026-35905?

T3 Technology CPE devices in your environment contain hardcoded credentials allowing unauthenticated remote attackers to gain full system control; no public exploit has been identified at time of…

How to fix or mitigate CVE-2026-35905?

Within 24 hours: inventory all T3 Technology CPE devices in production, identify affected models and versions, isolate from untrusted networks. Within 7 days: implement network segmentation and access controls restricting device connectivity, enable comprehensive logging and alerting on unauthorized access attempts, contact T3 Technology for patch availability and replacement timelines. Within 30 days: execute replacement or authenticated-firmware upgrade plan for all affected units, verify remediation completion, conduct forensic assessment for indicators of prior compromise.

T3 Technology CPE CVE-2026-35905

EUVD-2026-34275 CRITICAL

Use of Hard-coded Password (CWE-259)

2026-06-04 mitre

GHSA-chq3-rh33-9xqp

Authentication Bypass N A

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 17:50 vuln.today

CVSS changed

Jun 08, 2026 - 15:37 NVD

9.8 (None) 9.8 (CRITICAL)

CVE Published

Jun 04, 2026 - 00:00 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

T3 Technology CPE models T625Pro v1.0.07, T6825G v1.0.03, and T7281 v1.0.03 were discovered to contain a hardcoded password for root access under the "superadmin" account.

AnalysisAI

Hardcoded root credentials in T3 Technology CPE devices (models T625Pro v1.0.07, T6825G v1.0.03, and T7281 v1.0.03) allow remote unauthenticated attackers to gain full root-level control via the built-in 'superadmin' account. The CVSS 9.8 rating reflects network-reachable, no-interaction exploitation with total impact to confidentiality, integrity, and availability, and SSVC marks the issue as automatable with total technical impact. No public exploit identified at time of analysis, and EPSS remains very low (0.02%) despite the severity, suggesting limited current scanning activity.

Technical ContextAI

T3 Technology CPEs are customer-premises equipment (broadband/router-class devices) commonly deployed by telecom operators - references to NCSA (Thailand's National Cyber Security Agency) and True Corporation suggest deployment within Thai ISP networks. The root cause maps to CWE-259 (Use of Hard-coded Password), a credential-management failure where a static secret is embedded in firmware rather than provisioned per device. Because the 'superadmin' account grants root, the hardcoded value bypasses any per-customer authentication layer and effectively functions as a vendor backdoor, accessible through whichever management interface the firmware exposes (typically HTTP(S), Telnet, or SSH on CPE platforms).

RemediationAI

No vendor-released patch identified at time of analysis; defenders should monitor https://t3techgroup.com and the NCSA advisory channel (https://www.ncsa.or.th) for firmware updates that remove or randomize the 'superadmin' credential, and consult the researcher advisory at https://github.com/PwnOnu/T3-Technology-CPE-Advisories/blob/main/CVE-2026-35905.md for confirmed details. As compensating controls, block inbound access to the device management interfaces (commonly TCP/22, TCP/23, TCP/80, TCP/443, and TR-069 on TCP/7547) from the WAN side via upstream ACLs - this breaks remote support workflows but eliminates internet-facing exposure; restrict LAN-side management to a dedicated VLAN or operator subnet, accepting that field technicians will need jump-host access; and where possible disable the 'superadmin' account or change its password if the firmware permits, noting that hardcoded credentials are often re-enabled on reboot or after configuration reset. ISPs operating these CPEs at scale should also push configuration templates that null-route or filter the management ports at the access-network edge while planning a coordinated firmware rollout.