Loading story…
A critical vulnerability, tracked as CVE-2025-66237, has been identified in Sunbird's DCIM dcTrack and Power IQ platforms. The flaw involves the use of default and hard-coded credentials, which could allow an attacker to gain administrative access to the database, escalate privileges, or execute system commands on the host. The vulnerability affects DCIM dcTrack and Power IQ versions 9.2.0 and prior, and has been assigned a CVSS v4 base score of 8.4, indicating high severity.
According to CISA, successful exploitation of this vulnerability could enable unauthorized access or credential theft. The advisory highlights that an attacker leveraging these hard-coded credentials could compromise the integrity and security of the affected systems, potentially leading to broader network exposure. Organizations using impacted Sunbird products are urged to review mitigation guidance and update their systems to address this critical security risk.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
On 2025-12-04, CVE-2025-66237 was published as a high-severity use of hard-coded credentials vulnerability in Sunbird DCIM dcTrack and Power IQ. The entry listed CISA ICS-CERT as the source, assigned a CVSS v4 score of 8.4, and recommended changing default credentials, rotating hard-coded credentials, and enforcing a secure password policy.
In the advisory published on 2025-12-04, Sunbird recommended upgrading dcTrack to version 9.2.3 and Power IQ to version 9.2.1 to address the disclosed vulnerabilities. CISA also said no known public exploitation specifically targeting these flaws had been reported at the time of publication.
On 2025-12-04, CISA published an ICS advisory for Sunbird DCIM dcTrack and Power IQ affecting version 9.2.0 and earlier. The advisory described CVE-2025-66238 and CVE-2025-66237 as remotely exploitable, low-complexity flaws that could enable unauthorized access, credential theft, privilege escalation, command execution, and access to restricted services or data.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Rich Source **DMS+ (Non-Mobile)** contains a critical hard-coded credentials flaw tracked as **`CVE-2026-18452`** that allows **unauthenticated remote attackers** to use a fixed embedded API key to gain administrative control over affected DMS+ instances and the devices they manage. The vulnerability affects **versions 5.63 and earlier** and is classified as **CWE-798: Use of Hard-coded Credentials**. The issue carries a **CVSS v3.1 score of 9.8** with impact to confidentiality, integrity, and availability, and public reporting said exploitation requires no authentication and low attack complexity. **Rich Source** addressed the flaw in **version 5.64**, while **TWCERT/CC** published an advisory; no active exploitation had been reported at the time of publication.
Jul 31, 2026
A critical vulnerability, tracked as CVE-2025-42890, was discovered in the non-GUI variant of SAP's SQL Anywhere Monitor. The flaw stems from hardcoded credentials being embedded in the application's code, which exposes sensitive resources and functionality to unauthorized users. This vulnerability allows attackers to potentially achieve arbitrary code execution, posing a severe risk to the confidentiality, integrity, and availability of affected systems. The vulnerability has been assigned the maximum CVSS score of 10.0, highlighting its critical nature and the urgency for remediation. SAP addressed this issue in its November security updates, which also included fixes for other high-severity vulnerabilities. The SQL Anywhere Monitor is commonly used by organizations to oversee distributed or remote databases, and the non-GUI component is often deployed on unattended appliances, increasing the risk of exploitation due to limited oversight. SAP has urged customers to apply the security updates promptly to mitigate the risk associated with this flaw and prevent potential unauthorized access or system compromise.
Jun 29, 2026
**Honeywell IQ4x building management system (BMS) controllers** were reported to expose their full web-based HMI **without authentication in factory-default configurations**, tracked as **CVE-2026-3611**. When no web user module is configured, the device operates under a **System Guest (level 100)** context that can provide read/write access to anyone who can reach the HTTP interface; authentication is only enforced after a user is created. Because the user-creation function (via `U.htm`) is reachable prior to authentication, a remote attacker can create an administrative account, enable the user module under attacker-controlled credentials, and potentially **lock out legitimate operators**, with impacts including unauthorized access to management settings, component control, information disclosure, and denial of service. This is **not fluff**; it is a concrete ICS/OT vulnerability disclosure with clear exploitation conditions and operational impact. However, several other items in the set are separate CISA ICS advisories for different products and CVEs (Inductive Automation Ignition deserialization leading to code execution; Apeman camera issues enabling device takeover/viewing feeds; and multiple Lantronix EDS vulnerabilities including auth bypass and root-level command injection) and should be treated as **distinct security stories** rather than part of the Honeywell IQ4x event.
Jun 29, 2026