CVE-2026-11849

CriticalCVSS 9.8/10Last modified Oct 26, 2026

Description

The iRM-IEI Remote Management developed by IEI Integration Corp has a Hardcoded Credentials vulnerability, allowing unauthenticated remote attackers to exploit hard-coded credentials to gain administrative privileges on the database.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-798

Affected software

Vendor	Product	Versions
IEI Integration Corp	iRM-TSi410X	< 1.4.19

References

Timeline

Published: Jun 12, 2026
Last modified: Oct 26, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1184922.0In Eclipse Langium versions 3.0.0 and later, the langium-sprotty package does not HTML-escape diagnostic messages before rendering them in t CVE-2026-1184948.2Joomla Extension - jreviews.com - Secret configs cached in a web-accessible in JReviews 1.0.0-5.12.0, 6.0.0-6.6.9 - JReviews caches its full CVE-2026-1184958.8Joomla / WordPress Extension - acymailing.com - Exposure of sensitive information to an unauthorized actor in AcyMailing 6.0.0 - 11.1.1 - Ex CVE-2026-11858.8A configuration file on the local file system had improper input validation which could allow code execution and potentially lead to privile CVE-2026-118505.0An integer underflow vulnerability was found in MIT krb5 in the berval2tl_data() function in plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c.CVE-2026-1185006.4The Cool FormKit Lite – Advanced Form Builder for Elementor plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via CVE-2026-1185046.5The web interface blocks issue and pull request changes on archived repositories, but several issue routes of the REST API did not check whe CVE-2026-1185056.3Improper Restriction of Excessive Authentication Attempts vulnerability in team-alembic ash_authentication allows an unauthenticated attacke CVE-2026-118515.9Improper Neutralization of Special Elements used in an SQL Command ("SQL Injection") in the web management interface of certain ASUS router CVE-2026-1185108.8A type-handling flaw in the relationship query building of this MongoDB integration library can cause a check for the absence of a related r CVE-2026-1185137.7Authentication bypass by spoofing in X509Authenticator and X509AuthenticationListener of Symfony versions prior to 5.4.56, 6.x prior to 6.4.CVE-2026-1185146.3In Symfony http-foundation prior to versions 5.4.56, 6.4.50, 7.4.23, and 8.1.11, Symfony\Component\HttpFoundation\RequestMatcher, and Reques