EUVD-2026-84683
GHSA-hq78-xpfh-qmh9
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain firmware or /etc/shadow
-
DeliveryCrack reversible root/guest hashes offline
-
ExploitConnect to exposed Telnet/SSH
-
ExecutionAuthenticate with recovered credentials
-
ImpactGain full root OS control
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Credential externalization
MITRE ATT&CK
2 techniques across 2 tactics: Persistence, Credential Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the device to expose its Telnet or SSH service (reachable to the attacker) and requires the attacker to first recover the hard-coded root/guest passwords by cracking the reversible hashes stored in /etc/shadow using dictionary-based tools - the AT:P attack requirement. The limiting factor is this offline cracking step (which is feasible because the hashes are reversible/weak and identical across all LTK3500SF AC3F_V1.1.0_build191121 units); no user interaction and no prior authentication are needed. Realistic risk is bounded by network exposure of the management services and by the narrow deployment base of this specific device. |
| Impact | This is a genuinely serious flaw on affected devices, but the real-world footprint is narrow. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H, base 9.2) reflects unauthenticated network access yielding total system compromise, and SSVC corroborates this (Technical Impact: total, Automatable: yes). The AT:P (attack requirement present) metric correctly captures that exploitation is not fully turnkey - the attacker must first recover the credentials by cracking the reversible /etc/shadow hashes with dictionary tools before authenticating. Signals are mostly consistent: a public exploit exists (SSVC Exploitation: poc, confirmed by a GitHub PoC reference) but this is NOT active-in-the-wild exploitation - there is no CISA KEV listing. The low EPSS score (0.51%, 43rd percentile) is consistent with the absence of KEV: despite the PoC and 'automatable: yes' rating, mass exploitation probability is modeled as low, pointing to targeted rather than widespread abuse - which fits an obscure embedded product with a small internet-facing population. Net: high technical severity, high confidence in the finding, but priority should be scoped to organizations actually operating this device, not treated as a broad emergency. |
| Exploit ScenarioDerived | An attacker extracts the LTK3500SF firmware (or /etc/shadow), runs a dictionary-based cracking tool against the reversible root and guest password hashes, and recovers the credentials - which are shared across all units. They then connect to the device's exposed Telnet or SSH service and log in as root, obtaining full control of the operating system. A public proof-of-concept for this hard-coded-credentials issue is already published on GitHub. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Sep 23, 2026
Hard-coded credentials in LTSecurity LTK3500SF devices allow unauthenticated remote attackers who can reach Telnet or SSH to recover the root and guest passwords from reversible hashes in /etc/shadow and obtain full root-level operating system access. The affected firmware is AC3F_V1.1.0_build191121, and because the hashes are weak/reversible and identical across units, one successful cracking effort can compromise any reachable device. Publicly available exploit code exists, but there is no confirmed active exploitation (not in CISA KEV); EPSS is 0.51%, and real-world risk is bounded by the narrow deployment base and management-service exposure.
Earlier versions of this analysis (1)
Hard-coded root and guest credentials in the LTSecurity LTK3500SF let unauthenticated remote attackers log in over Telnet or SSH and obtain full root-level control of the underlying operating system. The passwords are stored as reversible hashes in /etc/shadow, have already been recovered with dictionary-based cracking tools, are identical across units of this model, and publicly available exploit code exists (no CISA KEV confirmation of active exploitation at time of analysis). The sole practical precondition is network reachability to the device's Telnet or SSH service, so internet-exposed or unsegmented LTK3500SF units carry the highest risk, while units behind firewalls or with remote management disabled are far harder to reach.
RemediationAI
No vendor-released patch is identified in the provided data, and no exact fixed version is available, so remediation must rely on compensating controls until LTSecurity provides firmware that removes the hard-coded credentials. Disable Telnet and SSH management services if they are not operationally required; the trade-off is loss of remote CLI management. If remote management is required, block TCP/22 and TCP/23 from untrusted networks and restrict access to a dedicated management VLAN or VPN, accepting the need for network reconfiguration and jump-host access. Change the root and guest passwords if the device supports it and if the change persists across reboots, but treat this as partial mitigation because the original reversible hashes remain embedded and recoverable from firmware. Isolate the LTK3500SF on a dedicated VLAN and monitor Telnet/SSH authentication attempts for signs of exploitation, with the trade-off of added segmentation and logging overhead. Consult the VulnCheck advisory https://www.vulncheck.com/advisories/ltsecurity-ltk3500sf-hard-coded-credentials-via-telnet-ssh, the public PoC https://github.com/AndreaLandriscina/Hardcoded-Credentials-in-LTSecurity-LTK3500SF, and the NVD record https://nvd.nist.gov/vuln/detail/CVE-2026-47116 for updates.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-798, use of hard-coded credentials. LTSecurity LTK3500SF stores root and guest account passwords in /etc/shadow as reversible hashes rather than strong one-way salted hashes, so an attacker can perform offline dictionary-based cracking. The CPE cpe:2.3:a:ltsecurity:ltk3500sf:*:*:*:*:*:*:*:* identifies the affected product family, and EUVD lists AC3F_V1.1.0_build191121 as the affected version. Once the cleartext password is recovered, it can be used for remote login via Telnet or SSH; the assessed CVSS:3.1 vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H and the CVSS:4.0 AT:P requirement both reflect that the cracking step is a prerequisite, while no user interaction or prior authentication is needed. Because the same credential material is shared across units, compromise scales to any exposed LTK3500SF running the affected firmware.
Know when Ltk3500Sf gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Network-reachable Telnet/SSH with no prior auth (PR:N) but AC:H because credentials must first be recovered by cracking reversible hashes; successful login yields full root, so C/I/A:H.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
3DescriptionCVE.org
LTSecurity LTK3500SF contains a hard-coded credentials vulnerability where root and guest account passwords are stored as reversible hashes in /etc/shadow, recoverable using dictionary-based cracking tools. Attackers can use the recovered credentials to authenticate via Telnet or SSH and obtain full root-level access to the operating system.
Technical POC Analysis
Bug class: CWE-798, Use of Hard-coded Credentials.
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Latest POC
1 PoC candidate from github (unverified)
Sign in to open the public PoC links collected for this CVE.
Executive ViewAI
Hard-coded credentials in LTSecurity LTK3500SF devices running firmware AC3F_V1.1.0_build191121 allow anyone who can reach the device's Telnet or SSH service to recover the root and guest passwords from reversible hashes and gain full administrative control of the underlying operating system. Because the hashes are weak and identical across every unit, a single cracking effort compromises the entire deployed fleet rather than a single device. Leadership should care because no vendor patch is currently available, remediation depends on network isolation and eventual device replacement, and the narrow deployment footprint limits - but does not remove - organizational exposure.
No vendor-released patch identified at time of analysis. Interim mitigations: block or disable Telnet (TCP 23) and SSH (TCP 22) so only a hardened management VLAN or jump host can reach LTK3500SF devices; remove or replace hard-coded root and guest credentials where the platform permits; isolate affected units on a dedicated network segment with strict access control; and monitor for unexpected management-service connections indicating credential harvesting attempts. Publicly available exploit code exists; no confirmed actively exploited (CISA KEV) activity at time of analysis.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB