Loading story…
Rich Source DMS+ (Non-Mobile) contains a critical hard-coded credentials flaw tracked as CVE-2026-18452 that allows unauthenticated remote attackers to use a fixed embedded API key to gain administrative control over affected DMS+ instances and the devices they manage. The vulnerability affects versions 5.63 and earlier and is classified as CWE-798: Use of Hard-coded Credentials.
The issue carries a CVSS v3.1 score of 9.8 with impact to confidentiality, integrity, and availability, and public reporting said exploitation requires no authentication and low attack complexity. Rich Source addressed the flaw in version 5.64, while TWCERT/CC published an advisory; no active exploitation had been reported at the time of publication.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
TWCERT/CC published an advisory for CVE-2026-18452, a hard-coded credentials flaw in Rich Source DMS+ (Non-Mobile). The advisory described that affected versions up to 5.63 could be remotely compromised via a fixed API key.
Rich Source fixed a hard-coded credentials vulnerability in DMS+ (Non-Mobile) by releasing version 5.64. The flaw affected version 5.63 and earlier and allowed unauthenticated remote attackers to use a fixed API key to gain administrative control over DMS+ instances and managed devices.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A critical vulnerability, tracked as CVE-2025-66237, has been identified in Sunbird's DCIM dcTrack and Power IQ platforms. The flaw involves the use of default and hard-coded credentials, which could allow an attacker to gain administrative access to the database, escalate privileges, or execute system commands on the host. The vulnerability affects DCIM dcTrack and Power IQ versions 9.2.0 and prior, and has been assigned a CVSS v4 base score of 8.4, indicating high severity. According to CISA, successful exploitation of this vulnerability could enable unauthorized access or credential theft. The advisory highlights that an attacker leveraging these hard-coded credentials could compromise the integrity and security of the affected systems, potentially leading to broader network exposure. Organizations using impacted Sunbird products are urged to review mitigation guidance and update their systems to address this critical security risk.
Jun 29, 2026
A critical security vulnerability, tracked as CVE-2025-6950, has been identified in Moxa network security appliances and routers, allowing unauthenticated attackers to gain administrative access via a hard-coded JWT secret. The flaw, which carries a CVSS score of 9.9, stems from the use of a hard-coded secret key for signing JSON Web Tokens (JWT) used in the authentication process. This insecure implementation enables attackers to forge valid JWTs without any prior authentication, effectively bypassing all access controls. As a result, an attacker can impersonate any user, including administrators, and obtain full control over the affected device. Exploitation of this vulnerability can lead to unauthorized access, data theft, and complete system compromise. The vulnerability is remotely exploitable, significantly increasing the risk to organizations deploying these devices in critical network environments. According to the available reports, there is no evidence that exploitation of this flaw leads to loss of confidentiality or integrity in systems beyond the affected device itself. The vulnerability was disclosed by Moxa’s Product Security Incident Response Team (PSIRT) and has been publicly documented in multiple security advisories. Security researchers emphasize the severity of the issue due to the ease of exploitation and the potential impact on industrial and enterprise networks. The affected products include a range of Moxa network security appliances and routers, though specific model versions have not been detailed in the public advisories. Organizations using these devices are urged to review their deployments and apply any available patches or mitigations as soon as possible. The vulnerability was published and last updated on October 17, 2025, highlighting the need for immediate attention from network administrators. The flaw is distinct from other recent privilege escalation vulnerabilities in Moxa products, as it allows for unauthenticated, rather than authenticated, administrative takeover. Security experts recommend monitoring for signs of unauthorized access and reviewing authentication logs for suspicious activity. The use of hard-coded credentials is a well-known security anti-pattern, and this incident underscores the importance of secure key management in authentication systems. Moxa has been notified and is expected to release further guidance and remediation steps. Until patches are available, organizations should consider network segmentation and access restrictions to limit exposure. The incident has raised concerns about the security of industrial control systems and the potential for similar flaws in other embedded network devices. The vulnerability’s critical rating and remote exploitability make it a high-priority issue for all organizations relying on Moxa network security appliances.
Jun 29, 2026
CISA added two high-severity vulnerabilities affecting specific **Milesight AIOT camera firmware** versions, exposing the devices through embedded secrets in the product. **`CVE-2026-27785`** is a **hard-coded credentials** flaw (`CWE-798`) that can allow unauthorized access without privileges or user interaction, with impact spanning confidentiality, integrity, and availability. The issue was listed with a CVSS v3.1 vector of `AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`, indicating attackers on an adjacent network could exploit the weakness to take control of affected cameras. CISA also published **`CVE-2026-32644`**, a **hard-coded cryptographic key** issue (`CWE-321`) tied to SSL certificates that use default private keys in Milesight camera firmware. That flaw carries a critical CVSS v3.1 vector of `AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`, meaning it is remotely exploitable over the network and could enable full compromise of device communications and operations. The disclosures were accompanied by CISA advisory and CSAF references, as well as vendor firmware download links for affected Milesight products.
Jun 29, 2026