EUVD-2026-70868
GHSA-mqpg-g4xh-h9jm
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain SmartIT application code
-
DeliveryExtract hard-coded SSH credentials
-
ExploitReach SmartIT Agent SSH service
-
ExecutionAuthenticate with static account
-
ImpactExecute commands / compromise managed endpoints
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Credential externalization
MITRE ATT&CK
2 techniques across 2 tactics: Persistence, Credential Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The attacker needs access to the SmartIT Desktop Manager application source/binaries (from which the credential is read) and network SSH reachability to the SmartIT Agent service that trusts the hard-coded account; per the CVSS vector no authentication, privileges, or user interaction are required (AV:N/AC:L/PR:N/UI:N). The practical limiting factor is exposure of the code and of agent SSH: if the application package is tightly distributed and agent SSH is not reachable from attacker-controlled networks, real-world exploitation narrows considerably despite the network attack vector. |
| Impact | The signals are consistent and point to genuine high priority: the CVSS 4.0 base is 9.3 with AV:N/AC:L/PR:N/UI:N and VC:H/VI:H/VA:H, meaning network reach, low complexity, no privileges and no user interaction, with high confidentiality, integrity and availability impact once the SSH creds are used. There is no EPSS score, KEV listing, or public PoC in the provided data, so exploitation is not confirmed in the wild - this is a high-CVSS issue whose real-world exploitation currently rests on how widely the source/binaries have circulated rather than on an off-the-shelf exploit. Given the low deployment footprint of this Taiwan-market product, exploitation is more likely to be targeted than mass-scanned, yet the payoff (shared SSH access to managed endpoints) is severe enough that any organisation running it should treat credential rotation and patching as urgent. The one caveat is that the vendor-supplied CVSS assumes the source is effectively reachable by an unauthenticated attacker; if source/binaries are tightly held, practical attack surface is narrower than AV:N implies - verify exposure with the vendor. |
| Exploit ScenarioDerived | An attacker obtains a copy of the SmartIT Desktop Manager application - for example by downloading an installer, unpacking a client build, or reading files on a reachable install - and greps the source for the embedded SSH service-account username and password. Using those static credentials, they SSH into managed SmartIT Agents across the customer estate and execute commands as the service account, pivoting to broader endpoint compromise. No authentication to the product and no user interaction are required. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 04, 2026
Credential disclosure in Lightstar's SmartIT Desktop Manager lets unauthenticated remote attackers extract the SSH service-account username and password for the SmartIT Agent directly from the shipped application source code (CWE-798). Because the same hard-coded SSH credentials are reused across deployments, recovering them once yields authenticated SSH access to managed agents, enabling remote command execution and full compromise of endpoints under management. No public exploit has been identified at time of analysis, but retrieval requires no more than reading the product's own code.
RemediationAI
No specific vendor-released patch version is identified in the available data - refer to the TWCERT/CC advisories (https://www.twcert.org.tw/en/cp-139-11177-13ca3-2.html) for Lightstar's fixed build and upgrade instructions, and apply the vendor update as the primary fix since only the vendor can remove the hard-coded secret and re-provision per-install credentials. As compensating controls until patched: rotate/disable the exposed SSH service account on all SmartIT Agents and, where the software permits, replace password auth with per-host key-based authentication; restrict inbound SSH to agents so it is reachable only from the management server via network ACLs or host firewall (trade-off: breaks any out-of-band administration that relied on that path); and place the management plane on a segmented VLAN to limit which hosts can reach agent SSH. Note that rotating the account only helps if the product does not hard-fail when the built-in credential changes - validate agent connectivity after rotation and coordinate with the vendor to avoid breaking the management channel.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
SmartIT Desktop Manager is an endpoint/desktop management suite (CPE cpe:2.3:a:lightstar:smartit_desktop_manager) whose management server communicates with a distributed 'SmartIT Agent' over SSH. The flaw is a classic Use of Hard-coded Credentials (CWE-798): the SSH service account and its password are embedded as static literals inside the application source rather than provisioned per-install or randomized at deployment. Anyone able to obtain the code - a customer, a leaked build, a decompiled/unpacked package, or a copy pulled from an accessible install - obtains the standing credential that every agent trusts, collapsing the SSH authentication boundary to a shared secret with no per-tenant separation.
Know when Smartit Desktop Manager gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Hard-coded creds readable without auth then reused over network SSH give AV:N/AC:L/PR:N/UI:N; resulting SSH access yields full C/I/A on managed agents.
Primary rating from Vendor (twcert).
CVSS VectorVendor: twcert
DescriptionCVE.org
SmartIT Desktop Manager developed by Lightstar has a Use of Hard-coded Credentials vulnerability. Unauthenticated remote attackers can obtain the SSH service account credentials and passwords for the SmartIT Agent directly from the application source code.
Executive ViewAI
Lightstar SmartIT Desktop Manager contains a critical supply chain vulnerability: administrative credentials for managed endpoints are permanently embedded in the product's code. Any attacker with access to the application can obtain these credentials, then use them to establish SSH access across all organizational endpoints simultaneously-no authentication required. This transforms a single product weakness into organization-wide infrastructure compromise with no workaround until patched.
No vendor-released patch identified at time of analysis. Implement network segmentation to restrict SSH access to managed agents from only trusted management systems using firewall rules and VLANs; deploy enhanced monitoring for unauthorized SSH activity and lateral movement attempts; apply the principle of least privilege by isolating affected agent networks if operationally feasible; maintain detailed audit logs of all management operations and SSH connections for forensic investigation; engage threat hunting to identify any prior unauthorized access to managed endpoints.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB