Plaintext Credential Storage in HMS Products
⚠️ CVE-Referenzen:
CVE-2026-39460
Red Lion Controls - 700 Series - CRITICAL - CVE-2026-39460.
This vulnerability allows for the exposure of sensitive information, as usernames and passwords, including default factory credentials, are stored in plaintext within a configuration file. Attackers with administrator access can easily view this file through the command line interface (CLI) or by exporting it via TFTP from the web interface. Notably, the TFTP transfer can be initiated through SNMP, which does not require authentication, thereby increasing the risk of unauthorized access. Ensuring proper credential management and securing configuration files are essential to mitigate this vulnerability.
Quelle: securityvulnerability.io