EUVD-2026-76737
GHSA-r5jf-jfmr-83g3
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Reading the world-readable file still requires a local user account (PR:L); only confidentiality is impacted through offline hash recovery.
Primary rating from Vendor (hq).
CVSS VectorVendor: hq
Lifecycle Timeline
1DescriptionCVE.org
The administrative password is hashed using a comparatively weak, fast algorithm for the credential store backing one authentication path, and the file containing that hash is written with permissions allowing it to be read by any local user. This is inconsistent with a separate, stronger hashing algorithm used for the same password on another authentication path. A party able to read this file, including a local user or a party with access to a configuration backup, could feasibly recover the underlying password through offline computation, compromising the administrative credential across every path that accepts it.
AnalysisAI
Weak password hashing combined with world-readable file permissions in an ICS inventory-management component allows any local OS user-or any party possessing a configuration backup-to offline-crack the administrative password and authenticate as administrator across every authentication path the product supports. The credential store backing one authentication path stores the admin password hash using a computationally cheap algorithm (CWE-916), inconsistently with a stronger algorithm applied on a second authentication path, and the hash file is written with permissions permitting any local user to read it. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires local OS access to the system running the ICS inventory-management component, or access to a configuration backup file exported from that system. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N) scores 6.9 Medium, accurately capturing a local-only attack surface with no complexity or privilege barrier beyond local OS access-consistent with the world-readable file permission. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Consult the vendor advisory published under ICSA-26-254-01 (CSAF source: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2026/icsa-26-254-01.json) for the confirmed patched version and vendor-specific instructions. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today