EUVD-2026-76738
GHSA-xvc8-c6gw-4q63
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable admin login with a public default credential yields full C/I/A; AC:H because exploitation depends on the operator having deployed the example file without credential regeneration.
Primary rating from Vendor (hq).
CVSS VectorVendor: hq
Lifecycle Timeline
3DescriptionCVE.org
An example environment-configuration file for a bundled inventory-management component ships with a fixed, publicly-known administrative password. A deployment that copies this example file into active configuration without running the setup routine that regenerates credentials will expose that component's administrative interface to anyone aware of the default value.
AnalysisAI
Unauthenticated administrative access to a bundled inventory-management component (CVE-2026-90456) is possible when operators deploy the shipped example configuration file, which contains a fixed, publicly-known default administrative password. Any deployment that copies this example environment file into active configuration without executing the setup routine that regenerates credentials exposes the component's admin interface to anyone who knows the well-documented default value. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the deployment copied the shipped example environment-configuration file into active use WITHOUT running the setup routine that regenerates credentials - this specific misconfiguration (reflected as AT:P in the CVSS 4.0 vector) is the mandatory prerequisite. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 base score of 9.2 reflects network reachability (AV:N), low complexity (AC:L), no privileges or user interaction (PR:N/UI:N), and full high impact to confidentiality, integrity, and availability of the vulnerable component (VC:H/VI:H/VA:H). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The reliable fix is operational: run the product's documented setup/initialization routine so it regenerates a unique administrative credential, or manually change the administrative password away from the shipped default in the active configuration and never deploy the example configuration file verbatim. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all deployments of the inventory-management component and verify whether any are running the shipped example configuration; if so, immediately run the credential-regeneration setup routine to establish new administrative credentials. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-1392 – Use of Default Credentials
View allShare
External POC / Exploit Code
Leaving vuln.today