Monthly
Multiple Rakuten Mobile Android handsets - Rakuten Mini, Rakuten Hand, Rakuten Hand 5G, and Rakuten Bigs - ship with AOSP default test keys still trusted by Android Verified Boot, so a system image signed with those publicly known keys passes boot integrity verification instead of being rejected. An attacker with physical possession of the handset and the ability to enter its flashing/fastboot mode can therefore install a crafted system image and gain full control of confidentiality, integrity, and availability (VC:H/VI:H/VA:H), which is the basis for the CVSS 4.0 base score of 7.0 (HIGH), gated heavily by the AV:P physical-access prerequisite. There is no public exploit code identified at time of analysis and no confirmed active exploitation (no CISA KEV listing); the risk is concentrated in lost, stolen, seized, or resold devices rather than any remote or network-reachable attack path.
Authentication bypass in the Grav Login OAuth plugin before 1.4.3 lets unauthenticated remote attackers derive valid credentials for OAuth-provisioned accounts and take administrative control. The plugin assigns each auto-provisioned user a deterministic '<provider>.<id>' username and an unsalted MD5 hash of the provider identifier as the password, and it leaves password login enabled; anyone who learns or guesses the provider identifier can reproduce the login. No public exploit identified at time of analysis; the vendor-assigned CVSS 4.0 score is 9.3 Critical and the assessed CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N.
Anjvision YSSD-RTMP-H5 cameras running firmware 3.3.2.4 retain a legacy password hash that is exposed on the device's serial (UART) console and protected only by weak DES-based encryption, so an attacker who already has physical access to the hardware with low-level local privileges can lift the hash and crack it offline to recover usable credentials. The attack vector is physical (CVSS AV:P), which rules out any remote or network exploitation, and no public exploit code or confirmed active exploitation has been identified at time of analysis (the product is not listed in CISA KEV). Despite the 7.0 (CVSS 4.0 High) headline score, this is a physical-access hardening weakness and the practical risk is low given the prerequisites.
The EVbee DC-80 firmware ships with a hardcoded root password, allowing unauthenticated remote attackers to log in via SSH and gain full control of the device. All units share the same static credential, which can be recovered from firmware analysis, and no special configuration is needed. This is a high-severity flaw (CVSS 9.3) with no public exploit code identified at time of analysis.
Weak credential management in the mapp Audit component of B&R Industrial Automation's mapp Services framework allows network-accessible, unauthenticated attackers to leverage predictable or default credentials to gain unauthorized access with high confidentiality and integrity impact on downstream industrial systems connected through the platform. All mapp Services versions prior to 6.8.0 are affected. No public exploit or CISA KEV listing has been identified at time of analysis, but the OT/ICS deployment context - where integrity compromise can translate to physical process disruption - elevates the practical severity beyond the numeric score.
Predictable secure-key generation in Slican telephone exchanges (IPx, CCT-1668, MAC-6400, and CXS-0424 series) lets a remote unauthenticated attacker reconstruct the device's secure key from exchange properties that are readable without credentials, then derive administrator credentials. The flaw is network-reachable with low attack complexity and no authentication (CVSS 4.0 base 8.7), and while fixed firmware is available for supported lines, discontinued 4.xx and earlier units remain permanently exposed. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Brute-force authentication bypass in CashDro 3 web administration panel 24.01.00.26 enables remote unauthenticated attackers to gain full administrative access. The system accepts numeric PINs without account lockout mechanisms, a legacy design from 2012 POS integrations. Successful exploitation grants access to confidential configuration settings with high impact to confidentiality and integrity (CVSS 9.3). No public exploit identified at time of analysis, though exploitation is trivial given the vulnerability class. Patch available per vendor advisory from INCIBE.
Local attackers can gain full system access to Dell PowerProtect Data Domain storage systems without authentication due to weak default credentials in DD OS versions 7.7.1.0-8.5, 8.3.1.0-8.3.1.20, and 7.13.1.0-7.13.1.50. The vulnerability allows complete system compromise (CVSS 8.4) with high confidentiality, integrity, and availability impact despite requiring local access. No active exploitation confirmed (EPSS 0.01%, not in CISA KEV), and Dell has released patches across all affected release branches. SSVC framework rates this as total technical impact but non-automatable and not currently exploited.
Default admin credentials in OpenMQ message broker. Shipped with known default admin password.
TDC X401GL firmware contains hardcoded default credentials for privileged user accounts, enabling unauthenticated attackers to gain unauthorized administrative access over the network. This vulnerability affects all deployments using default configurations and could allow attackers to compromise system integrity and perform unauthorized operations. No patch is currently available.
Multiple Rakuten Mobile Android handsets - Rakuten Mini, Rakuten Hand, Rakuten Hand 5G, and Rakuten Bigs - ship with AOSP default test keys still trusted by Android Verified Boot, so a system image signed with those publicly known keys passes boot integrity verification instead of being rejected. An attacker with physical possession of the handset and the ability to enter its flashing/fastboot mode can therefore install a crafted system image and gain full control of confidentiality, integrity, and availability (VC:H/VI:H/VA:H), which is the basis for the CVSS 4.0 base score of 7.0 (HIGH), gated heavily by the AV:P physical-access prerequisite. There is no public exploit code identified at time of analysis and no confirmed active exploitation (no CISA KEV listing); the risk is concentrated in lost, stolen, seized, or resold devices rather than any remote or network-reachable attack path.
Authentication bypass in the Grav Login OAuth plugin before 1.4.3 lets unauthenticated remote attackers derive valid credentials for OAuth-provisioned accounts and take administrative control. The plugin assigns each auto-provisioned user a deterministic '<provider>.<id>' username and an unsalted MD5 hash of the provider identifier as the password, and it leaves password login enabled; anyone who learns or guesses the provider identifier can reproduce the login. No public exploit identified at time of analysis; the vendor-assigned CVSS 4.0 score is 9.3 Critical and the assessed CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N.
Anjvision YSSD-RTMP-H5 cameras running firmware 3.3.2.4 retain a legacy password hash that is exposed on the device's serial (UART) console and protected only by weak DES-based encryption, so an attacker who already has physical access to the hardware with low-level local privileges can lift the hash and crack it offline to recover usable credentials. The attack vector is physical (CVSS AV:P), which rules out any remote or network exploitation, and no public exploit code or confirmed active exploitation has been identified at time of analysis (the product is not listed in CISA KEV). Despite the 7.0 (CVSS 4.0 High) headline score, this is a physical-access hardening weakness and the practical risk is low given the prerequisites.
The EVbee DC-80 firmware ships with a hardcoded root password, allowing unauthenticated remote attackers to log in via SSH and gain full control of the device. All units share the same static credential, which can be recovered from firmware analysis, and no special configuration is needed. This is a high-severity flaw (CVSS 9.3) with no public exploit code identified at time of analysis.
Weak credential management in the mapp Audit component of B&R Industrial Automation's mapp Services framework allows network-accessible, unauthenticated attackers to leverage predictable or default credentials to gain unauthorized access with high confidentiality and integrity impact on downstream industrial systems connected through the platform. All mapp Services versions prior to 6.8.0 are affected. No public exploit or CISA KEV listing has been identified at time of analysis, but the OT/ICS deployment context - where integrity compromise can translate to physical process disruption - elevates the practical severity beyond the numeric score.
Predictable secure-key generation in Slican telephone exchanges (IPx, CCT-1668, MAC-6400, and CXS-0424 series) lets a remote unauthenticated attacker reconstruct the device's secure key from exchange properties that are readable without credentials, then derive administrator credentials. The flaw is network-reachable with low attack complexity and no authentication (CVSS 4.0 base 8.7), and while fixed firmware is available for supported lines, discontinued 4.xx and earlier units remain permanently exposed. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Brute-force authentication bypass in CashDro 3 web administration panel 24.01.00.26 enables remote unauthenticated attackers to gain full administrative access. The system accepts numeric PINs without account lockout mechanisms, a legacy design from 2012 POS integrations. Successful exploitation grants access to confidential configuration settings with high impact to confidentiality and integrity (CVSS 9.3). No public exploit identified at time of analysis, though exploitation is trivial given the vulnerability class. Patch available per vendor advisory from INCIBE.
Local attackers can gain full system access to Dell PowerProtect Data Domain storage systems without authentication due to weak default credentials in DD OS versions 7.7.1.0-8.5, 8.3.1.0-8.3.1.20, and 7.13.1.0-7.13.1.50. The vulnerability allows complete system compromise (CVSS 8.4) with high confidentiality, integrity, and availability impact despite requiring local access. No active exploitation confirmed (EPSS 0.01%, not in CISA KEV), and Dell has released patches across all affected release branches. SSVC framework rates this as total technical impact but non-automatable and not currently exploited.
Default admin credentials in OpenMQ message broker. Shipped with known default admin password.
TDC X401GL firmware contains hardcoded default credentials for privileged user accounts, enabling unauthenticated attackers to gain unauthorized administrative access over the network. This vulnerability affects all deployments using default configurations and could allow attackers to compromise system integrity and perform unauthorized operations. No patch is currently available.