Which versions of Advantech ECU-1251D are affected by CVE-2026-6890?

Advantech ECU-1251D industrial communication gateways deployed in your infrastructure ship with remote root SSH access enabled by default with no password, creating an open door for any attacker on…

How to fix or mitigate CVE-2026-6890?

Within 24 hours, identify all Advantech ECU-1251D devices on your network using asset discovery tools and restrict SSH access via firewall rules to administrative networks only; disable root SSH login at the device level if operationally safe. Within 7 days, implement network segmentation to isolate these devices on a restricted management VLAN and contact Advantech to confirm patch status and inquire about firmware updates or alternative product recommendations. Within 30 days, develop a remediation roadmap with your operations and procurement teams-prioritize replacement with alternative industrial gateway vendors if Advantech confirms no patch will be released; at minimum, ensure no ECU-1251D device is accessible from production networks, guest networks, or the internet.

Advantech ECU-1251D CVE-2026-6890

Q: What is the CVSS score of CVE-2026-6890?

CVE-2026-6890 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X.

EUVD-2026-51379 HIGH

2026-07-31 CSA

GHSA-hp8c-4hvc-jr88

Information Disclosure Ecu 1251D08 04 Advantech

7.1

CVSS 4.0 · Vendor: CSA

Severity by source

Vendor (CSA) PRIMARY

7.1 HIGH

CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.8 HIGH

SSH is reachable on the adjacent/management network (AV:A), needs no credentials (PR:N/UI:N/AC:L), and a root login grants full read/write control, so C/I/A are all High.

3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (CSA).

CVSS VectorVendor: CSA

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 31, 2026 - 03:13 vuln.today

CVE Published

Jul 31, 2026 - 02:27 cve.org

HIGH 7.1

DescriptionCVE.org

A use of default credentials vulnerability in the Advantech ECU-1251D allows a remote attacker to gain unauthorised access to the device via SSH using the default root account with no password, as documented in the device manual. No prompt or guidance to change these credentials is provided during device configuration, increasing the risk of exploitation.

AnalysisAI

Default-credential unauthorized access affects the Advantech ECU-1251D industrial communication gateway, which ships with a root SSH account protected by no password and is documented as such in the device manual. An attacker on the same network segment can log in as root over SSH without any credential, and because configuration provides no prompt or guidance to change these defaults, exploitable devices are likely to persist in the field. No public exploit identified at time of analysis, but the vulnerability requires no exploitation skill - knowledge of the documented default is sufficient.

Technical ContextAI

The Advantech ECU-1251D is an edge/substation communication computer used in power and industrial automation environments to bridge field protocols to management networks. The root cause is the use of default credentials (CWE-798 / CWE-1392 class; CWE listed as N/A in the source): the device exposes an SSH service bound to a root account configured with an empty password. Because this is baked into the shipped image and published in the manual, the 'secret' is effectively public, and the absence of any first-boot credential-change enforcement means the weak state is the default operational state rather than a misconfiguration. The affected build is identified by CPE cpe:2.3:a:advantech:ecu-1251d08.04, corresponding to the ECU-1251D 08.04 firmware/model string.

RemediationAI

No vendor-released patch version is identified at time of analysis in the provided data, so remediation centers on operator action: immediately set a strong, unique password for the root account on every ECU-1251D and, where the platform allows, disable direct root SSH login (use PermitRootLogin no with a separate least-privilege administrative account). Restrict SSH (TCP/22) access to the device to a dedicated management VLAN via firewall/ACL so it is unreachable from field and corporate networks, accepting the trade-off that remote administration must then traverse a jump host. Where SSH is not operationally required, disable the SSH service entirely. Consult CSA advisory AL-2026-095 (https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2026-095/) and Advantech's security advisories for any firmware update, and after any factory reset re-apply these credential changes since defaults will be restored.