EUVD-2026-63795
GHSA-7q54-468c-p268
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach DMC management interface
-
DeliverySubmit default admin credentials
-
ExploitObtain administrative session
-
ExecutionModify or disable auditing policies
-
ImpactExfiltrate database activity data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Default credential prevention
|
| Exploitation Conditions | Exploitation requires that the affected DMC instance (v8.3.0-v8.5.1) still uses the factory default administrator credentials AND that the attacker has network reachability to the management interface. There is no authentication barrier in the CVSS sense (PR:N) and no user interaction required (UI:N) - the 'credential' is the publicly known default. What LIMITS exploitation is configuration hygiene: any operator who has already changed the default administrator password is not exploitable, and network segmentation that keeps the management console off attacker-reachable networks blocks the vector. The concrete prerequisite is therefore an unchanged default admin account exposed on a reachable network path. |
| Impact | Signals are consistent and point to genuine priority where the product is exposed: the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes trivially automatable, unauthenticated network exploitation with high confidentiality, integrity, and availability impact on the vulnerable system (VC:H/VI:H/VA:H), yielding a 9.3 critical score. The limiting factor is not attack difficulty but exposure and configuration: exploitation only works while the default credentials remain unchanged and the management interface is reachable by the attacker. No EPSS score, POC, or KEV entry was provided, so real-world exploitation frequency is unconfirmed - the low technical friction is offset by the product's niche footprint (Datiphy is a specialized vendor, not ubiquitous software), which likely keeps mass scanning less common than for mainstream appliances. Net: treat as urgent for any organization actually running DMC, but overall internet-wide prevalence is limited. |
| Exploit ScenarioDerived | An attacker who can reach the DMC management interface - from the internet if exposed, or from an adjacent network segment - browses to the login page and authenticates with the product's documented default administrator credentials. With administrative access they can alter or disable database auditing policies, exfiltrate captured database activity data, and pivot within the monitored environment. No exploit code is required beyond knowledge of the default credentials; no public exploit identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 21, 2026
Administrative account takeover in Datiphy Data Management Center (v8.3.0 through v8.5.1) lets a remote attacker log into the management platform using shipped default administrator credentials, granting full control over the database-activity-monitoring console. Rated CVSS 4.0 9.3 (critical) with a fully network-reachable, unauthenticated vector, though no public exploit identified at time of analysis and no CISA KEV listing exists. Because the console governs database auditing and policy, compromise undermines the very security telemetry it is meant to provide.
RemediationAI
No vendor-released patch identified at time of analysis, so the primary and immediately actionable control is to change the default administrator credentials on every DMC instance to a strong, unique password (and rotate any other factory accounts) - this directly removes the vulnerable condition without functional side effects. Additionally, restrict network access to the DMC management interface to trusted administrative networks or a VPN/jump host, which limits who can attempt the default login should any account be missed; the trade-off is added friction for remote administrators. Consult the vendor advisory at https://zuso.ai/advisory for any updated fixed release, and once Datiphy publishes a patched version, upgrade to it. Do not expose the management console to the public internet.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Datiphy Data Management Center (DMC) is the central console of Datiphy's database activity monitoring and data-security platform, used to define auditing policies, review database transaction telemetry, and administer sensors. The root cause is CWE-1392 (Use of Default Credentials): the product ships with a pre-set administrator account whose credentials are known/documented and are not forced to change on first use. The single affected CPE is cpe:2.3:a:datiphy_inc.:data_management_center, confirming the flaw is in the management application itself rather than an underlying OS or database. Any deployment that retains the factory administrator login exposes that credential over the network-facing management interface.
Know when Data Management Center gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Publicly known default credentials over the network require no earned privileges (PR:N) and no interaction; full admin control gives high C/I/A with unchanged scope.
Primary rating from Vendor (ZUSO ART).
CVSS VectorVendor: ZUSO ART
DescriptionCVE.org
Use of default credentials in Datiphy Data Management Center from v8.3.0 through v8.5.1 allows a remote attacker to gain administrative access to the management platform by logging in with default administrator credentials.
Executive ViewAI
Datiphy Data Management Center versions 8.3.0 through 8.5.1 contain a critical vulnerability enabling remote administrative account takeover via shipped default credentials, with no public exploit identified at time of analysis. The unauthenticated, network-reachable attack grants full control over the database-activity-monitoring console, allowing attackers to disable auditing, modify policies, and exfiltrate security logs. This vulnerability is particularly severe because it compromises the security monitoring infrastructure organizations depend on to detect and respond to breaches, creating a blind spot in database access governance.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Immediately change all default administrative credentials to complex, unique passwords; (2) Enforce network segmentation using firewall rules, IP allowlisting, or VPN/bastion-host access for the administrative console; (3) Deploy independent database-activity logging via a separate SIEM or third-party audit aggregator to capture logs outside the Datiphy console, preventing attackers from disabling audit trails; (4) Enable multi-factor authentication on all administrative accounts if the platform supports it; (5) Establish daily alerts for any administrative login attempts or console policy modifications; (6) Urgently evaluate upgrade feasibility to post-8.5.1 versions or alternative vendors within 30 days.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB