Dms Non Mobile
Monthly
Full device takeover in Rich Source DMS+ (Non-Mobile) is possible because the product ships with a hard-coded API key that is identical across all deployments. Unauthenticated remote attackers who obtain or extract this fixed key can authenticate to the management interface and seize control of every installed DMS+ device, with maximal confidentiality, integrity, and availability impact (CVSS 4.0 base 10.0). There is no public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.
Full device takeover in Rich Source DMS+ (Non-Mobile) is possible because the product ships with a hard-coded API key that is identical across all deployments. Unauthenticated remote attackers who obtain or extract this fixed key can authenticate to the management interface and seize control of every installed DMS+ device, with maximal confidentiality, integrity, and availability impact (CVSS 4.0 base 10.0). There is no public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.