Ltk3500Sf
Monthly
Hard-coded credentials in LTSecurity LTK3500SF devices allow unauthenticated remote attackers who can reach Telnet or SSH to recover the root and guest passwords from reversible hashes in /etc/shadow and obtain full root-level operating system access. The affected firmware is AC3F_V1.1.0_build191121, and because the hashes are weak/reversible and identical across units, one successful cracking effort can compromise any reachable device. Publicly available exploit code exists, but there is no confirmed active exploitation (not in CISA KEV); EPSS is 0.51%, and real-world risk is bounded by the narrow deployment base and management-service exposure.
Hard-coded credentials in LTSecurity LTK3500SF devices allow unauthenticated remote attackers who can reach Telnet or SSH to recover the root and guest passwords from reversible hashes in /etc/shadow and obtain full root-level operating system access. The affected firmware is AC3F_V1.1.0_build191121, and because the hashes are weak/reversible and identical across units, one successful cracking effort can compromise any reachable device. Publicly available exploit code exists, but there is no confirmed active exploitation (not in CISA KEV); EPSS is 0.51%, and real-world risk is bounded by the narrow deployment base and management-service exposure.