Monthly
Session cookie forgery in Zabbix 7.4 is possible because the cryptographic key used to sign Frontend sessions is erroneously written to the database seed, making it readable by anyone with adjacent database access. The vendor-confirmed exploitation path is narrowly scoped: only deployments running both SAML authentication and guest users simultaneously are at known risk, where the extracted key can be used to forge valid session cookies and achieve unauthorized frontend access. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, and the vendor explicitly states no known impact for deployments outside the SAML-plus-guest-user configuration.
Hard-coded TR-069 remote management credentials in LB-LINK X-PRO firmware 1.0.22-20231206 allow network-accessible unauthenticated attackers to authenticate to the device's CWMP interface via static credentials embedded in /etc/config/easycwmp. A public proof-of-concept exploit has been released, effectively eliminating the primary barrier to exploitation. The vendor was unresponsive to coordinated disclosure, and no patch has been issued; no public exploit identified at time of analysis as confirmed active exploitation (CISA KEV listing absent), though publicly available exploit code exists.
Hard-coded credentials embedded in the /etc/shadow file of the LB-LINK X-PRO wireless router (firmware 1.0.22-20231206) allow remote attackers who obtain those static credentials to authenticate to the device's management interface without any privilege requirement. The affected product is also marketed as the B-Link AC1200 X-PRO (model AC6). A public proof-of-concept has been published, effectively neutralizing the high attack complexity barrier by making the hardcoded password discoverable; no vendor patch exists because the vendor did not respond to disclosure, leaving all deployed units permanently vulnerable to authentication bypass and full device compromise.
Hard-coded SSH credentials embedded in Tenda CH, CP, and TX3 camera firmware across versions V21.x through V27.x expose all affected devices to remote authentication bypass, granting shell-level access to any attacker who obtains the static password. A GitHub-published proof-of-concept documents the exact credential and exploitation steps, significantly collapsing the barrier imposed by the CVSS 4.0 AC:H rating. No vendor-released patch has been identified at time of analysis, and no CISA KEV listing has been issued, though the public exploit makes this a credible near-term threat for network-exposed devices.
Hardcoded static credentials in Cisco Secure Firewall Management Center (FMC) Software allow an unauthenticated remote attacker to log in to the web interface using a built-in low-privileged account and access sensitive data. The flaw affects an extensive range of FMC versions from 7.0.0 through 10.0.1 and is rooted in CWE-259 (Use of Hard-coded Password). Cisco has self-elevated the Security Impact Rating to High - despite a CVSS 5.3 Medium score - explicitly because this credential foothold can be chained with other FMC vulnerabilities to escalate privileges, making the real-world risk materially higher than the base score implies. No public exploit or CISA KEV listing has been confirmed at time of analysis.
Hard-coded credential exposure in SourceCodester's Online Examination & Learning Management System 1.0 (also distributed as Syllabus-aligned Learning Management and Examination System 1.0) allows remote unauthenticated attackers to exploit a statically embedded password ('CICT_2026') in the import_users.php file without any authentication or user interaction. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms fully unauthenticated remote exploitation at low complexity, and the E:P exploit maturity modifier alongside the CVE description's explicit statement of public disclosure confirm that publicly available exploit code exists. Impact is constrained to low confidentiality exposure against the vulnerable component with no confirmed integrity or availability consequences.
Unauthenticated password reset bypass in SourceCodester Barangay Resident Profiling and Information Management System 1.0 allows remote attackers to reset user accounts to a known hard-coded credential via the `passsword_reset.php` endpoint. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms no authentication or user interaction is required, and the E:P modifier confirms publicly available exploit code exists. Despite the VI:L integrity-only CVSS impact rating, the Authentication Bypass tag indicates the realistic consequence is full account takeover for any user whose password can be reset to the predictable hard-coded value 'password123'.
Hardcoded root credentials in T3 Technology CPE devices (models T625Pro v1.0.07, T6825G v1.0.03, and T7281 v1.0.03) allow remote unauthenticated attackers to gain full root-level control via the built-in 'superadmin' account. The CVSS 9.8 rating reflects network-reachable, no-interaction exploitation with total impact to confidentiality, integrity, and availability, and SSVC marks the issue as automatable with total technical impact. No public exploit identified at time of analysis, and EPSS remains very low (0.02%) despite the severity, suggesting limited current scanning activity.
Hard-coded credentials embedded in NetApp Active IQ OneCollect 2.7.3 allow any low-privileged authenticated user to perform unauthorized AutoSupport operations beyond their intended authorization scope. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) confirms network-accessible exploitation with low complexity, requiring only a low-privilege account with no special attack conditions. No public exploit has been identified and the vulnerability does not appear in the CISA KEV catalog at time of analysis.
Hard-coded credentials in NetApp Active IQ Config Advisor 6.7.3 enable authenticated low-privileged attackers to perform unauthorized AutoSupport operations against connected NetApp infrastructure. The embedded credentials bypass intended access controls, allowing any account holder to trigger or manipulate AutoSupport telemetry functions beyond their assigned privilege level. No public exploit code exists and this vulnerability has not been added to the CISA KEV catalog at time of analysis.
Session cookie forgery in Zabbix 7.4 is possible because the cryptographic key used to sign Frontend sessions is erroneously written to the database seed, making it readable by anyone with adjacent database access. The vendor-confirmed exploitation path is narrowly scoped: only deployments running both SAML authentication and guest users simultaneously are at known risk, where the extracted key can be used to forge valid session cookies and achieve unauthorized frontend access. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, and the vendor explicitly states no known impact for deployments outside the SAML-plus-guest-user configuration.
Hard-coded TR-069 remote management credentials in LB-LINK X-PRO firmware 1.0.22-20231206 allow network-accessible unauthenticated attackers to authenticate to the device's CWMP interface via static credentials embedded in /etc/config/easycwmp. A public proof-of-concept exploit has been released, effectively eliminating the primary barrier to exploitation. The vendor was unresponsive to coordinated disclosure, and no patch has been issued; no public exploit identified at time of analysis as confirmed active exploitation (CISA KEV listing absent), though publicly available exploit code exists.
Hard-coded credentials embedded in the /etc/shadow file of the LB-LINK X-PRO wireless router (firmware 1.0.22-20231206) allow remote attackers who obtain those static credentials to authenticate to the device's management interface without any privilege requirement. The affected product is also marketed as the B-Link AC1200 X-PRO (model AC6). A public proof-of-concept has been published, effectively neutralizing the high attack complexity barrier by making the hardcoded password discoverable; no vendor patch exists because the vendor did not respond to disclosure, leaving all deployed units permanently vulnerable to authentication bypass and full device compromise.
Hard-coded SSH credentials embedded in Tenda CH, CP, and TX3 camera firmware across versions V21.x through V27.x expose all affected devices to remote authentication bypass, granting shell-level access to any attacker who obtains the static password. A GitHub-published proof-of-concept documents the exact credential and exploitation steps, significantly collapsing the barrier imposed by the CVSS 4.0 AC:H rating. No vendor-released patch has been identified at time of analysis, and no CISA KEV listing has been issued, though the public exploit makes this a credible near-term threat for network-exposed devices.
Hardcoded static credentials in Cisco Secure Firewall Management Center (FMC) Software allow an unauthenticated remote attacker to log in to the web interface using a built-in low-privileged account and access sensitive data. The flaw affects an extensive range of FMC versions from 7.0.0 through 10.0.1 and is rooted in CWE-259 (Use of Hard-coded Password). Cisco has self-elevated the Security Impact Rating to High - despite a CVSS 5.3 Medium score - explicitly because this credential foothold can be chained with other FMC vulnerabilities to escalate privileges, making the real-world risk materially higher than the base score implies. No public exploit or CISA KEV listing has been confirmed at time of analysis.
Hard-coded credential exposure in SourceCodester's Online Examination & Learning Management System 1.0 (also distributed as Syllabus-aligned Learning Management and Examination System 1.0) allows remote unauthenticated attackers to exploit a statically embedded password ('CICT_2026') in the import_users.php file without any authentication or user interaction. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms fully unauthenticated remote exploitation at low complexity, and the E:P exploit maturity modifier alongside the CVE description's explicit statement of public disclosure confirm that publicly available exploit code exists. Impact is constrained to low confidentiality exposure against the vulnerable component with no confirmed integrity or availability consequences.
Unauthenticated password reset bypass in SourceCodester Barangay Resident Profiling and Information Management System 1.0 allows remote attackers to reset user accounts to a known hard-coded credential via the `passsword_reset.php` endpoint. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms no authentication or user interaction is required, and the E:P modifier confirms publicly available exploit code exists. Despite the VI:L integrity-only CVSS impact rating, the Authentication Bypass tag indicates the realistic consequence is full account takeover for any user whose password can be reset to the predictable hard-coded value 'password123'.
Hardcoded root credentials in T3 Technology CPE devices (models T625Pro v1.0.07, T6825G v1.0.03, and T7281 v1.0.03) allow remote unauthenticated attackers to gain full root-level control via the built-in 'superadmin' account. The CVSS 9.8 rating reflects network-reachable, no-interaction exploitation with total impact to confidentiality, integrity, and availability, and SSVC marks the issue as automatable with total technical impact. No public exploit identified at time of analysis, and EPSS remains very low (0.02%) despite the severity, suggesting limited current scanning activity.
Hard-coded credentials embedded in NetApp Active IQ OneCollect 2.7.3 allow any low-privileged authenticated user to perform unauthorized AutoSupport operations beyond their intended authorization scope. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) confirms network-accessible exploitation with low complexity, requiring only a low-privilege account with no special attack conditions. No public exploit has been identified and the vulnerability does not appear in the CISA KEV catalog at time of analysis.
Hard-coded credentials in NetApp Active IQ Config Advisor 6.7.3 enable authenticated low-privileged attackers to perform unauthorized AutoSupport operations against connected NetApp infrastructure. The embedded credentials bypass intended access controls, allowing any account holder to trigger or manipulate AutoSupport telemetry functions beyond their assigned privilege level. No public exploit code exists and this vulnerability has not been added to the CISA KEV catalog at time of analysis.