Armatura One CVE-2026-94592

Exploitation requires that (1) the attacker already has access to the host server operating system running Armatura One, and (2) the database superuser's vendor-defined default password has not been changed from its shipped value since installation. The vulnerability is fully mitigated on deployments where an administrator has reset the superuser password. Limiting factors: no network attack path (AV:L), so it is not remotely exploitable over a network, and it depends on the insecure default configuration persisting post-install; it does not require user interaction or prior application-level authentication once OS access is obtained.

This is a hardcoded/vendor-default credentials flaw (CWE-798) in Armatura One where the database superuser is assigned a fixed, vendor-defined password at installation. The vendor-supplied CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:N) scores 8.6 largely because of full VC:H/VI:H/VA:H impact to the database, but the Attack Vector is Local - the description explicitly requires 'access to the server operating system' before the static password can be used, which materially lowers real-world risk versus a network-reachable flaw. There is no EPSS score, no CISA KEV listing, and no public exploit code in the provided intelligence, so exploitation status is 'no public exploit identified at time of analysis.' The PR:N rating reflects that no application credentials are needed once the known password is used, but it understates the practical precondition of obtaining OS-level access to the host. Net: a genuinely serious post-access privilege/data-compromise issue for the database, but not an internet-facing mass-exploitation priority - treat as high-priority hardening on exposed/shared hosts rather than an emergency network patch. Note signal gap: no EPSS/KEV/POC data was supplied, so exploitation likelihood cannot be quantitatively corroborated.

An attacker who has already gained access to the server operating system hosting Armatura One (e.g., a local user, a low-privileged service account, or via another foothold) connects to the local database using the publicly/vendor-known default superuser password that was never changed. With superuser access they read, modify, or destroy all access-control and biometric data. No public exploit code is required - only knowledge of the fixed password and the AV:L/AC:L conditions make this straightforward once OS access exists.