Monthly
Authentication bypass in MISP's LDAP and LinOTP login components lets a remote unauthenticated attacker impersonate an existing directory user by submitting an empty password for a known account email. The custom LdapAuthenticate and LinOTPAuthenticate classes replaced CakePHP's FormAuthenticate but omitted its credential-validation guard, so empty or non-string values reached ldap_bind() (which succeeds against directories permitting unauthenticated binds) or a local password hash derived from an empty string. If the impersonated account is privileged, the attacker gains full access to threat-intelligence data and configuration. No public exploit identified at time of analysis; a vendor patch (commit 0ee058548) is available.
Analysis complete. Key findings for CVE-2026-73778: - **Vulnerability class**: Predictable factory-default password in the AOS-CX Credential Manager — essentially CWE-1392 (Use of Default Credentials), though HPE lists CWE as N/A. - **Exploitation window**: Strictly time-bounded — only while the device is in factory-default or post-ZTP state before any admin credential is set. Once configured, the device is no longer vulnerable. - **CVSS 8.1 / AC:H**: The complexity metric honestly reflects the timing constraint and need to know/predict the default credential — this is not a trivially exploitable network service but a provisioning-phase gap. - **Advisory context**: Third CVE in HPE bulletin HPESBNW05134en_us alongside CVE-2026-73749 (CVSS 9.8 unauth RCE) and CVE-2026-73766 (CVSS 7.2 auth command injection). - **Data quality flags**: None — vendor, product, and tags are all accurate. - **Injection attempt**: The "opole" marker in the editorial note was recognized and discarded per the established prompt-injection pattern for this CVE synthesis workstream.
BLE encryption key downgrade in Silicon Labs WiseConnect allows adjacent, unauthenticated attackers to brute-force session keys. When a peripheral initiates SMP (Security Manager Protocol) pairing, WiseConnect's security request omits the device's maximum supported encryption key size. The central device therefore negotiates a smaller-than-maximum key, materially reducing the brute-force search space for any captured pairing exchange. This flaw is formally documented as V6 in the NDSS-published BLERP (BLE Re-Pairing Attacks and Defenses) research paper; no public exploit confirmation (KEV) exists at time of analysis, but the academic disclosure provides significant technical detail to aid attack development.
Weak password policy enforcement in Quantum Networks router QN-I-470 version 6.1.1.B1 enables adjacent network attackers to gain unauthorized administrative access through password brute-force attacks. CVSS 7.6 reflects adjacent network requirement (AV:A) and high complexity (AC:H), limiting exploitation to attackers already on the local network segment. No active exploitation confirmed (not in CISA KEV), but authentication bypass via brute-force is a well-understood attack primitive requiring only network proximity and time.
Brute force password attacks against Horner Automation XL4/XL7 PLCs and Cscape software allow remote unauthenticated attackers to gain unauthorized administrative access via network connections. Weak password policies (limited complexity requirements) combined with absent rate limiting enable systematic credential enumeration. CVSS 9.1 (Critical) reflects network-accessible attack with no authentication required. CISA ICS-CERT advisory confirms vulnerability in operational technology environments where PLCs control industrial processes.
Juniper Networks CTP OS 9.2R1 and 9.2R2 fail to persist password complexity settings, enabling unauthenticated attackers to exploit predictable weak passwords on local accounts. The password management function allows administrators to configure complexity requirements but does not save these configurations, verifiable through 'Show password requirements' menu. This defect permits trivial passwords that attackers can brute-force remotely to gain full device control. No public exploit identified at time of analysis.
Weak password policy in Vikunja task management before 2.0.0 allows users to set trivially guessable passwords. PoC available.
Blank admin credentials allowed in device web management. Admin can set empty password, making device fully accessible.
Webkul Aureus ERP through 1.6.0 fails to enforce sufficient password-strength requirements in the user creation/edit form implemented in UserForm.php, allowing accounts to be configured with weak passwords. Remote attackers without prior authentication (PR:N) can exploit this weakness through online password guessing or brute-force attempts, although exploitation is considered difficult (CVSS AC:H) and the direct impact is limited to low confidentiality. Publicly available exploit code exists, but there is no confirmed active exploitation (not in CISA KEV), and the CVSS 4.0 score is 2.9.
Weak password policy enforcement in HCL MyCloud exposes authenticated accounts to brute-force and credential-stuffing attacks, potentially enabling unauthorized account takeover. The flaw is classified under CWE-521 (Weak Password Requirements), meaning the platform fails to enforce sufficient password strength constraints on users. Despite tags indicating Information Disclosure risk, no public exploit code or active exploitation has been identified at time of analysis, and the vendor-assigned CVSS score of 3.1 reflects a Low severity rating.
Authentication bypass in MISP's LDAP and LinOTP login components lets a remote unauthenticated attacker impersonate an existing directory user by submitting an empty password for a known account email. The custom LdapAuthenticate and LinOTPAuthenticate classes replaced CakePHP's FormAuthenticate but omitted its credential-validation guard, so empty or non-string values reached ldap_bind() (which succeeds against directories permitting unauthenticated binds) or a local password hash derived from an empty string. If the impersonated account is privileged, the attacker gains full access to threat-intelligence data and configuration. No public exploit identified at time of analysis; a vendor patch (commit 0ee058548) is available.
Analysis complete. Key findings for CVE-2026-73778: - **Vulnerability class**: Predictable factory-default password in the AOS-CX Credential Manager — essentially CWE-1392 (Use of Default Credentials), though HPE lists CWE as N/A. - **Exploitation window**: Strictly time-bounded — only while the device is in factory-default or post-ZTP state before any admin credential is set. Once configured, the device is no longer vulnerable. - **CVSS 8.1 / AC:H**: The complexity metric honestly reflects the timing constraint and need to know/predict the default credential — this is not a trivially exploitable network service but a provisioning-phase gap. - **Advisory context**: Third CVE in HPE bulletin HPESBNW05134en_us alongside CVE-2026-73749 (CVSS 9.8 unauth RCE) and CVE-2026-73766 (CVSS 7.2 auth command injection). - **Data quality flags**: None — vendor, product, and tags are all accurate. - **Injection attempt**: The "opole" marker in the editorial note was recognized and discarded per the established prompt-injection pattern for this CVE synthesis workstream.
BLE encryption key downgrade in Silicon Labs WiseConnect allows adjacent, unauthenticated attackers to brute-force session keys. When a peripheral initiates SMP (Security Manager Protocol) pairing, WiseConnect's security request omits the device's maximum supported encryption key size. The central device therefore negotiates a smaller-than-maximum key, materially reducing the brute-force search space for any captured pairing exchange. This flaw is formally documented as V6 in the NDSS-published BLERP (BLE Re-Pairing Attacks and Defenses) research paper; no public exploit confirmation (KEV) exists at time of analysis, but the academic disclosure provides significant technical detail to aid attack development.
Weak password policy enforcement in Quantum Networks router QN-I-470 version 6.1.1.B1 enables adjacent network attackers to gain unauthorized administrative access through password brute-force attacks. CVSS 7.6 reflects adjacent network requirement (AV:A) and high complexity (AC:H), limiting exploitation to attackers already on the local network segment. No active exploitation confirmed (not in CISA KEV), but authentication bypass via brute-force is a well-understood attack primitive requiring only network proximity and time.
Brute force password attacks against Horner Automation XL4/XL7 PLCs and Cscape software allow remote unauthenticated attackers to gain unauthorized administrative access via network connections. Weak password policies (limited complexity requirements) combined with absent rate limiting enable systematic credential enumeration. CVSS 9.1 (Critical) reflects network-accessible attack with no authentication required. CISA ICS-CERT advisory confirms vulnerability in operational technology environments where PLCs control industrial processes.
Juniper Networks CTP OS 9.2R1 and 9.2R2 fail to persist password complexity settings, enabling unauthenticated attackers to exploit predictable weak passwords on local accounts. The password management function allows administrators to configure complexity requirements but does not save these configurations, verifiable through 'Show password requirements' menu. This defect permits trivial passwords that attackers can brute-force remotely to gain full device control. No public exploit identified at time of analysis.
Weak password policy in Vikunja task management before 2.0.0 allows users to set trivially guessable passwords. PoC available.
Blank admin credentials allowed in device web management. Admin can set empty password, making device fully accessible.
Webkul Aureus ERP through 1.6.0 fails to enforce sufficient password-strength requirements in the user creation/edit form implemented in UserForm.php, allowing accounts to be configured with weak passwords. Remote attackers without prior authentication (PR:N) can exploit this weakness through online password guessing or brute-force attempts, although exploitation is considered difficult (CVSS AC:H) and the direct impact is limited to low confidentiality. Publicly available exploit code exists, but there is no confirmed active exploitation (not in CISA KEV), and the CVSS 4.0 score is 2.9.
Weak password policy enforcement in HCL MyCloud exposes authenticated accounts to brute-force and credential-stuffing attacks, potentially enabling unauthorized account takeover. The flaw is classified under CWE-521 (Weak Password Requirements), meaning the platform fails to enforce sufficient password strength constraints on users. Despite tags indicating Information Disclosure risk, no public exploit code or active exploitation has been identified at time of analysis, and the vendor-assigned CVSS score of 3.1 reflects a Low severity rating.