EUVD-2025-18174Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection Source code protection
|
| Impact | Despite the moderate CVSS score of 7.5, this vulnerability carries HIGH real-world risk that likely exceeds numerical scoring: (1) Attack Vector is Network with no Authentication required (AV:N/PR:N), making it trivially exploitable from anywhere; (2) Attack Complexity is Low (AC:L), requiring no special conditions or race conditions; (3) Confidentiality Impact is High (C:H), granting full administrative access; (4) The CVSS vector shows no Integrity or Availability impact (I:N/A:N), which appears incongruent with 'full access to the application'—in practice, an admin user typically can modify or delete data, suggesting the score may underestimate real impact; (5) Hardcoded credential vulnerabilities are frequently automated in scanning tools and actively sought by threat actors through GitHub searches, making exploitation probability exceptionally high; (6) The presence of credentials in source code typically indicates the flaw existed for extended periods, maximizing exposure window. SSVC framework would likely rate this as IMMEDIATE action required due to exploitability, automatable discovery, and severe technical impact (full system compromise). |
| Exploit ScenarioDerived | An attacker discovers the affected application's GitHub repository (either public or obtained through OSINT), searches for common credential patterns in source files (passwords, API keys in comments, configuration files, hardcoded strings), and extracts the admin username and password. With no authentication or user interaction required, the attacker navigates to the application's login page, enters the extracted credentials, and gains full administrative access. From this position, the attacker can: create new admin accounts for persistence, exfiltrate sensitive data, modify business logic, inject malware into deployments, or pivot to connected systems. The entire compromise chain takes minutes and requires minimal technical skill. If source code was public for an extended period, multiple threat actors may have already compromised the system before discovery. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 14, 2026
Critical credential exposure vulnerability where admin login credentials and property configuration passwords are embedded directly in source code, enabling unauthenticated remote attackers to gain full administrative access to the affected application. The vulnerability has a CVSS score of 7.5 (High) with a network attack vector requiring no privileges or user interaction. While specific KEV/EPSS data and POC availability are not provided in the input, the presence of hardcoded credentials in source code represents a severe and often easily discoverable weakness that typically sees rapid exploitation once disclosed.
RemediationAI
Immediate remediation steps (in priority order): (1) ROTATE ALL CREDENTIALS IMMEDIATELY—reset admin passwords, regenerate API keys, and revoke any tokens that were exposed in source code; (2) Search all Git history and branches using tools like 'git log -p' or TruffleHog to identify when credentials were introduced and revoke them from all environments; (3) Implement pre-commit hooks (e.g., detect-secrets, git-secrets) to prevent future credential commits; (4) Remove credentials from source code and implement secure credential management: use environment variables, HashiCorp Vault, AWS Secrets Manager, or similar; (5) Audit all access logs and authentication records from the exposure window to detect compromise; (6) If source code was public, assume credential compromise and rotate all downstream systems (databases, APIs, cloud accounts); (7) Apply vendor patches once released (specific patch versions unavailable without vendor advisory); (8) Implement code scanning in CI/CD pipelines to detect sensitive information; (9) Audit and restrict Git repository access controls.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This vulnerability stems from CWE-540 (Inclusion of Sensitive Information in Source Code), a well-known secure coding anti-pattern where authentication credentials and sensitive configuration data are hardcoded into application source files rather than externalized through environment variables, configuration management systems, or secure vaults. The root cause involves developers committing plaintext credentials to version control systems (Git, SVN, etc.) or embedding them in compiled binaries/JAR files. Without specific CPE data provided, the affected product likely encompasses web applications, APIs, or backend services that rely on admin authentication. The vulnerability is particularly dangerous because source code is often accessible through multiple attack vectors: exposed Git repositories, decompiled binaries, container image inspection, or insider access.
Know when Media Server gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
Files in the source code contain login credentials for the admin user and the property configuration password, allowing an attacker to get full access to the application.
Executive ViewAI
CVE-2025-49182 exposes hardcoded administrative credentials in application source code, allowing unauthenticated attackers to gain full administrative access without authentication. This directly compromises system integrity, confidentiality, and availability across all instances running affected versions, requiring immediate remediation to prevent unauthorized control of critical application infrastructure.
Apply vendor patch. If patch deployment cannot be completed within 48 hours: implement network segmentation restricting administrative interface access to authorized IP ranges only; deploy WAF rules blocking suspicious authentication patterns; enforce multi-factor authentication on all administrative accounts; increase monitoring and alerting on authentication events and privilege escalation attempts.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
More in Media Server
View allAuthenticated code execution in Plex Media Server before 1.43.3.10861 is a genuine but privilege-gated code-execution fl
Improper neutralization of URL values in Plex Media Server's 'searchOne' parameter allows a remote attacker to invoke ot
A Buffer Overflow was discovered in EvoStream Media Server 1.7.1. Rated high severity (CVSS 7.5), this vulnerability is
Server-side request forgery in Plex Media Server before 1.43.3.10861 allows any authenticated user - including a low-tru
Server-side request forgery in Plex Media Server before 1.43.3.10861 allows a low-privileged, token-bearing caller to fo
Deserialization of Untrusted Data in Plex Media Server on Windows allows a remote, authenticated attacker to execute arb
In Plex Media Server 1.13.2.5154, the XML parsing engine for SSDP/UPnP functionality is vulnerable to an XML External En
Improper Access Control in Plex Media Server prior to June 15, 2020 allows any origin to execute cross-origin applicatio
Plex Media Server before 0.9.9.3 allows remote attackers to bypass the web server whitelist, conduct SSRF attacks, and e
Multiple directory traversal vulnerabilities in Plex Media Server before 0.9.9.3 allow remote attackers to read arbitrar
Improper Input Validation in Plex Media Server on Windows allows a local, unauthenticated attacker to execute arbitrary
media-server v1.0.0 was discovered to contain a Use-After-Free (UAF) vulnerability via the sip_uac_stop_timer function a
GitHub PoC
Exploit-DB