Mv 90 Xi
Monthly
Decodable credential storage in Itron MV-90 xi 3.0 lets an attacker who can read the product's configuration file recover stored passwords and password histories and then log in to MV-90 as any user, including privileged accounts. The attack is local, not remote: the assessed vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N) requires prior access to the host and a low-privileged account or equivalent filesystem read permission on the config file, after which no user interaction is needed, making this a privilege-escalation and lateral-movement primitive rather than an initial-access flaw. No public exploit has been identified at time of analysis (CISA SSVC records Exploitation: none), and the cross-vendor assessment rates technical impact as partial, so exploitation is opportunistic and contingent on the attacker already having a foothold with file-read access.
Decodable credential storage in Itron MV-90 xi 3.0 lets an attacker who can read the product's configuration file recover stored passwords and password histories and then log in to MV-90 as any user, including privileged accounts. The attack is local, not remote: the assessed vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N) requires prior access to the host and a low-privileged account or equivalent filesystem read permission on the config file, after which no user interaction is needed, making this a privilege-escalation and lateral-movement primitive rather than an initial-access flaw. No public exploit has been identified at time of analysis (CISA SSVC records Exploitation: none), and the cross-vendor assessment rates technical impact as partial, so exploitation is opportunistic and contingent on the attacker already having a foothold with file-read access.