Description

The affected products use hard-coded credentials, which could allow remote access to files with root privileges where FTP is reachable.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.6",
  "pubDate": "2026-09-15T21:16:42.090Z",
  "pubdate": "2026-09-15T21:16:42.090Z",
  "executiveSummary": "This vulnerability involves the presence of hard-coded credentials within the affected products, which introduces a significant security risk for unauthorized system access.\nThe vulnerability is categorized as the use of hard-coded credentials, a flaw that facilitates illicit authentication to services running on the device.\nThe primary impact of this flaw is unauthorized remote access to the file system with root-level privileges, effectively granting an attacker full control over the affected unit.\nAffected systems are exposed to remote compromise if the FTP service is reachable, making them high-value targets for attackers scanning for default or embedded credentials.\nThe exploitation of this vulnerability requires no specialized knowledge of the environment, as the credentials are static and embedded within the firmware or application binary.\nThe risk implication is critical, as it bypasses standard authentication mechanisms and permits arbitrary file manipulation, system configuration changes, or the deployment of persistent malicious payloads.\nAttackers can leverage this vulnerability to gain complete administrative oversight of the affected product, leading to potential data exfiltration, system instability, or lateral movement within the network.",
  "technicalDetails": "The root cause of this vulnerability is the implementation of static, hard-coded authentication credentials within the product's binary or configuration files. By embedding these credentials directly into the software, the manufacturer has bypassed secure password management practices, rendering the authentication mechanism predictable and susceptible to discovery through reverse engineering or static analysis of the firmware image.\nThe exploitation method relies on the accessibility of the FTP protocol. When the FTP service is exposed to a network interface, an attacker can initiate a standard connection request. Because the system relies on hard-coded credentials, the attacker simply provides the known, fixed username and password pair to authenticate successfully.\nThe attack flow follows a sequential process: First, the attacker identifies that the target device has an active FTP service reachable over the network. Second, the attacker utilizes the known hard-coded credentials to initiate an FTP session. Third, the authentication process succeeds without further verification, establishing a command-and-control conduit to the filesystem.\nOnce authenticated, the FTP service operates with root privileges. This means the attacker is not restricted by standard user-level permission boundaries. They gain the ability to perform read, write, and execute operations across the entire filesystem hierarchy. This includes the ability to modify system configuration files, replace legitimate binaries, or inject malicious scripts into startup directories to ensure persistence across reboots.\nThe vulnerability is inherent to the product's design, affecting any version where these static credentials remain hard-coded. There are no authentication or privilege requirements for the attacker other than the ability to reach the FTP service via the network; the hard-coded credentials themselves serve as the authorization token for the root account.\nPost-exploitation impact is severe. Beyond file access, an attacker can leverage this root-level entry to compromise other network segments, perform man-in-the-middle attacks by modifying system settings, or completely disable the security features of the product. The lack of cryptographic protection for these credentials ensures that once the binary is analyzed, the security of the entire device fleet is compromised."
}