Monthly
Remote authentication bypass in EseeCloud devices lets an unauthenticated attacker log in to the device management/login interface using a credential hard-coded into the product, yielding full control of the device (CVSS 4.0 base 9.3; independent assessment scores it CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Every condition for exploitation is attacker-friendly: no account, no user interaction, no non-default configuration, and no special network position beyond reachability of the management interface, so internet-exposed or cloud-reachable units are effectively open doors while NAT/firewall-isolated devices are shielded. No public exploit code or confirmed active exploitation (CISA KEV) is identified in the available data at time of analysis, and no EPSS score was provided, but the credential is embedded in the firmware rather than guessed, so the barrier to abuse is low wherever the interface is reachable. The flaw was reported to CISA's ICS-CERT program and published as advisory ICSA-26-288-02 under the Authentication Bypass tag.
Remote code execution in Jooan JA-A12 IP cameras running firmware 009_20171107 or 05.02.31.105 allows unauthenticated attackers to execute root-level commands by abusing hard-coded credentials. An attacker sends singleCMD=SetDiagMode to /goform/SingleHandlebyCommand with attacker-controlled authserverip and authcode values, causing the jooandiag daemon to run commands through /bin/sh and granting full device control. Publicly available exploit code exists, and the provided CVSS 4.0 score is 9.3; no CISA KEV listing is present in the supplied data.
The EnergizeLab AI Station (RK3562) firmware image ships with hard-coded root credentials and an SSH daemon enabled by default, so any attacker who can reach the device's SSH port from the same LAN or adjacent network segment can log in as root and take complete control of the unit. Rated CVSS 8.8 (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), the flaw needs no authentication, no user interaction, and no pre-existing privilege on the device - the only barrier is network reachability, per the adjacent-network attack vector. No vendor patch has been identified at time of analysis, and no public exploit code or confirmed active exploitation (CISA KEV) was identified; because every device running stock firmware is affected by design rather than by misconfiguration, this is a high-priority issue for any organization with these units deployed, not a paper-only finding.
Unauthenticated remote attackers can seize global super-admin control of Rapyd Admin installations running versions 9.0.0 through 9.19.x, because the framework's setup installer seeds a hard-coded administrator account (admin@laravel, password 'admin') that grants the highest privilege level in the application. The account is silently re-created on every execution of the `rpd:make` artisan command, so an operator who previously changed the password or removed the account can have the known credential restored without warning, and a successful login bypasses per-record authorization checks and multi-tenant scoping entirely. VulnCheck disclosed the issue with full source references, no public exploit code was identified at time of analysis, and no evidence of confirmed active exploitation (CISA KEV) is present; the vendor shipped the fix in v9.20.0, which creates the first admin once with a random password and never re-seeds it.
pH7Builder (pH7 Social Dating CMS) versions before 18.6.0 leak sensitive member records - email addresses, IP addresses, phone numbers, and bank account fields - to unauthenticated remote attackers who bypass the API's access checks. The bypass works because Tool.class.php ships a hard-coded API key (private_api_key=dev772277) and the authorization logic trusts the client-supplied Host header, so an attacker sending 'Host: localhost' along with that static key and the shipped default allowed URL is treated as authorized. No public exploit code has been identified at time of analysis and there is no KEV entry, but the independent assessment scores the issue CVSS v3.1 7.5 (AV:N/AC:L/PR:N/UI:N, C:H/I:N/A:N), a high-priority confidentiality-only exposure, with the vendor shipping 18.6.0 as the fix.
Unauthenticated remote attackers can achieve full administrative control of self-hosted Agnai instances (versions through 1.0.555) deployed with the default self-host.docker-compose.yml, which contains a hard-coded admin password and a public JWT secret. Attackers can log in as admin or forge a JWT with admin privileges to impersonate users, reset passwords, and modify server configuration. This critical vulnerability (CVSS 9.3) requires no user interaction and no prior authentication, but exploitation is limited to instances that have not overridden the default credentials and are network-reachable. No public exploit code has been identified at the time of analysis, though the hard-coded secrets are publicly visible in the repository.
Factory default administrator credentials on Red Lion Controls 700 Series devices remain active and cannot be removed by configuring additional administrator accounts, so an attacker who can reach the device's management interface can log in with administrative privileges on a device that operators believe is fully hardened. The independent assessment rates this as a high-impact, effectively unauthenticated network-reachable issue (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N), acknowledging that the supplied CVSS 4.0 vector marks PR:H while the defining feature - publicly known default credentials - means no legitimate account or privilege is required in practice. The practical limiting factor is reachability: ICS/OT networks are often segmented, so real-world exposure depends on whether the management interface is accessible from an attacker-controlled segment; no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, and no vendor fix version is disclosed in the available data.
Remote unauthenticated attackers can gain full administrative control of openPDC deployments provisioned from the official published Docker image, because that image embeds a fixed administrative credential that is not forced to change on first use. Exploitation requires only network reachability to the management interface and retention of the default credential; source-built or manually provisioned instances that set their own credentials are not affected. No public exploit code has been identified at time of analysis, though the vulnerable condition is inherent to the image and the CVSS 4.0 base score is 9.3, highlighting the severity for exposed deployments.
IBM Guardium Data Protection 12.0, 12.1, and 12.2 ship with hard-coded credentials that a remote, unauthenticated attacker (CVSS PR:N/UI:N) can abuse to read sensitive information from the affected appliance service, yielding a high confidentiality impact with no integrity or availability loss (C:H/I:N/A:N, base 7.5). Exploitation is not trivial in practice: the attacker must first know or recover the static credential value and must be able to reach the Guardium management or data service over the network, which is typically an internal, segmented appliance rather than an internet-facing endpoint. There is no confirmed active exploitation (not in CISA KEV), no public exploit code identified at time of analysis, and EPSS is only 0.30% (21st percentile), so this rates as a genuine but moderate-priority exposure that should be scheduled rather than emergency-patched.
Local privilege escalation in IBM Guardium Data Protection 12.2 allows an attacker who already holds low-privilege local access on the appliance to recover the root password through the pkcrypto passkey component and thereby obtain full root control, because that component combines weak cryptographic protection with a hard-coded recovery key (CWE-798). The exposure is confined to a local attack path (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning no network or unauthenticated remote vector exists and the attacker must first establish a foothold on the appliance - realistically an insider or someone who has already compromised the host by other means. There is no public exploit identified at time of analysis, CISA SSVC rates exploitation as none and the flaw as non-automatable while assigning total technical impact, and EPSS is 0.11% (1st percentile), so this is a serious but not urgent technical issue.
Remote authentication bypass in EseeCloud devices lets an unauthenticated attacker log in to the device management/login interface using a credential hard-coded into the product, yielding full control of the device (CVSS 4.0 base 9.3; independent assessment scores it CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Every condition for exploitation is attacker-friendly: no account, no user interaction, no non-default configuration, and no special network position beyond reachability of the management interface, so internet-exposed or cloud-reachable units are effectively open doors while NAT/firewall-isolated devices are shielded. No public exploit code or confirmed active exploitation (CISA KEV) is identified in the available data at time of analysis, and no EPSS score was provided, but the credential is embedded in the firmware rather than guessed, so the barrier to abuse is low wherever the interface is reachable. The flaw was reported to CISA's ICS-CERT program and published as advisory ICSA-26-288-02 under the Authentication Bypass tag.
Remote code execution in Jooan JA-A12 IP cameras running firmware 009_20171107 or 05.02.31.105 allows unauthenticated attackers to execute root-level commands by abusing hard-coded credentials. An attacker sends singleCMD=SetDiagMode to /goform/SingleHandlebyCommand with attacker-controlled authserverip and authcode values, causing the jooandiag daemon to run commands through /bin/sh and granting full device control. Publicly available exploit code exists, and the provided CVSS 4.0 score is 9.3; no CISA KEV listing is present in the supplied data.
The EnergizeLab AI Station (RK3562) firmware image ships with hard-coded root credentials and an SSH daemon enabled by default, so any attacker who can reach the device's SSH port from the same LAN or adjacent network segment can log in as root and take complete control of the unit. Rated CVSS 8.8 (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), the flaw needs no authentication, no user interaction, and no pre-existing privilege on the device - the only barrier is network reachability, per the adjacent-network attack vector. No vendor patch has been identified at time of analysis, and no public exploit code or confirmed active exploitation (CISA KEV) was identified; because every device running stock firmware is affected by design rather than by misconfiguration, this is a high-priority issue for any organization with these units deployed, not a paper-only finding.
Unauthenticated remote attackers can seize global super-admin control of Rapyd Admin installations running versions 9.0.0 through 9.19.x, because the framework's setup installer seeds a hard-coded administrator account (admin@laravel, password 'admin') that grants the highest privilege level in the application. The account is silently re-created on every execution of the `rpd:make` artisan command, so an operator who previously changed the password or removed the account can have the known credential restored without warning, and a successful login bypasses per-record authorization checks and multi-tenant scoping entirely. VulnCheck disclosed the issue with full source references, no public exploit code was identified at time of analysis, and no evidence of confirmed active exploitation (CISA KEV) is present; the vendor shipped the fix in v9.20.0, which creates the first admin once with a random password and never re-seeds it.
pH7Builder (pH7 Social Dating CMS) versions before 18.6.0 leak sensitive member records - email addresses, IP addresses, phone numbers, and bank account fields - to unauthenticated remote attackers who bypass the API's access checks. The bypass works because Tool.class.php ships a hard-coded API key (private_api_key=dev772277) and the authorization logic trusts the client-supplied Host header, so an attacker sending 'Host: localhost' along with that static key and the shipped default allowed URL is treated as authorized. No public exploit code has been identified at time of analysis and there is no KEV entry, but the independent assessment scores the issue CVSS v3.1 7.5 (AV:N/AC:L/PR:N/UI:N, C:H/I:N/A:N), a high-priority confidentiality-only exposure, with the vendor shipping 18.6.0 as the fix.
Unauthenticated remote attackers can achieve full administrative control of self-hosted Agnai instances (versions through 1.0.555) deployed with the default self-host.docker-compose.yml, which contains a hard-coded admin password and a public JWT secret. Attackers can log in as admin or forge a JWT with admin privileges to impersonate users, reset passwords, and modify server configuration. This critical vulnerability (CVSS 9.3) requires no user interaction and no prior authentication, but exploitation is limited to instances that have not overridden the default credentials and are network-reachable. No public exploit code has been identified at the time of analysis, though the hard-coded secrets are publicly visible in the repository.
Factory default administrator credentials on Red Lion Controls 700 Series devices remain active and cannot be removed by configuring additional administrator accounts, so an attacker who can reach the device's management interface can log in with administrative privileges on a device that operators believe is fully hardened. The independent assessment rates this as a high-impact, effectively unauthenticated network-reachable issue (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N), acknowledging that the supplied CVSS 4.0 vector marks PR:H while the defining feature - publicly known default credentials - means no legitimate account or privilege is required in practice. The practical limiting factor is reachability: ICS/OT networks are often segmented, so real-world exposure depends on whether the management interface is accessible from an attacker-controlled segment; no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, and no vendor fix version is disclosed in the available data.
Remote unauthenticated attackers can gain full administrative control of openPDC deployments provisioned from the official published Docker image, because that image embeds a fixed administrative credential that is not forced to change on first use. Exploitation requires only network reachability to the management interface and retention of the default credential; source-built or manually provisioned instances that set their own credentials are not affected. No public exploit code has been identified at time of analysis, though the vulnerable condition is inherent to the image and the CVSS 4.0 base score is 9.3, highlighting the severity for exposed deployments.
IBM Guardium Data Protection 12.0, 12.1, and 12.2 ship with hard-coded credentials that a remote, unauthenticated attacker (CVSS PR:N/UI:N) can abuse to read sensitive information from the affected appliance service, yielding a high confidentiality impact with no integrity or availability loss (C:H/I:N/A:N, base 7.5). Exploitation is not trivial in practice: the attacker must first know or recover the static credential value and must be able to reach the Guardium management or data service over the network, which is typically an internal, segmented appliance rather than an internet-facing endpoint. There is no confirmed active exploitation (not in CISA KEV), no public exploit code identified at time of analysis, and EPSS is only 0.30% (21st percentile), so this rates as a genuine but moderate-priority exposure that should be scheduled rather than emergency-patched.
Local privilege escalation in IBM Guardium Data Protection 12.2 allows an attacker who already holds low-privilege local access on the appliance to recover the root password through the pkcrypto passkey component and thereby obtain full root control, because that component combines weak cryptographic protection with a hard-coded recovery key (CWE-798). The exposure is confined to a local attack path (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning no network or unauthenticated remote vector exists and the attacker must first establish a foothold on the appliance - realistically an insider or someone who has already compromised the host by other means. There is no public exploit identified at time of analysis, CISA SSVC rates exploitation as none and the flaw as non-automatable while assigning total technical impact, and EPSS is 0.11% (1st percentile), so this is a serious but not urgent technical issue.