EUVD-2026-76742
GHSA-jf96-h34q-q5qw
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AC:H reflects the required misconfiguration precondition (example file used without secret regeneration); PR:N because once the known secret is obtained no credentials are needed.
Primary rating from Vendor (hq).
CVSS VectorVendor: hq
Lifecycle Timeline
3DescriptionCVE.org
An example environment-configuration file ships with a fixed, publicly-known secret value used to sign authentication cookies for a bundled packet-analysis component. A deployment that copies this example file into active configuration without running the setup routine that regenerates the value will use the known default, allowing an attacker aware of the default to forge valid authentication cookies for that component.
AnalysisAI
Cookie-signing secret forgery in an ICS platform's bundled packet-analysis component allows unauthenticated network attackers to bypass authentication entirely when the deployment was initialized from an example configuration file without running the required secret-regeneration routine. The vulnerability (CWE-1392) is contingent on a specific, detectable misconfiguration: the example .env-style file ships a publicly known static secret, and deployments that skip the setup step remain permanently vulnerable. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires two specific conditions to both be true: (1) the target deployment must have copied the example environment-configuration file into active use without running the vendor setup routine that regenerates the authentication cookie-signing secret, leaving the known-default value in place; and (2) the bundled packet-analysis component must be reachable by the attacker over the network. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 8.2 reflects a high-integrity impact (VI:H) with AT:P (attack target conditions present), meaning exploitation is conditional rather than universal. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The primary fix is to run the vendor-supplied setup routine that regenerates the authentication cookie-signing secret to a unique, random value for the deployment. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: identify all deployments of the affected ICS platform and determine which were initialized from example configuration files without secret regeneration. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-1392 – Use of Default Credentials
View allShare
External POC / Exploit Code
Leaving vuln.today