CVE-2026-39460

HighCVSS 8.1/10Last modified Oct 12, 2026

Description

Usernames and passwords, including the default factory credentials, are stored in plaintext within the configuration file. With administrator rights, the configuration file can be viewed through the CLI or they can be exported from the device through a TFTP transfer from the web interface. A TFTP transfer can be initiated through SNMP which does not require authentication.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-522

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Oct 9, 2026
Last modified: Oct 12, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-394618.8libcasper(3) communicates with helper processes via UNIX domain sockets, and uses the select(2) system call to wait for data to become avail CVE-2026-394628.1A vulnerability exists in SenseLive X3050’s web management interface in which password updates are not reliably applied due to improper hand CVE-2026-394637.1Unauthenticated Cross Site Scripting (XSS) in ManageWP Worker <= 4.9.31 versions.CVE-2026-394645.5Server-Side Request Forgery (SSRF) vulnerability in SeedProd Coming Soon Page, Under Construction & Maintenance Mode by SeedProd coming-soon CVE-2026-394659.1Editor Remote Code Execution (RCE) in Responsive Slider by MetaSlider <= 3.106.0 versions.CVE-2026-394667.6Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPMU DEV - Your All-in-One WordPress P CVE-2026-394677.2Deserialization of Untrusted Data vulnerability in MetaSlider Responsive Slider by MetaSlider allows Object Injection.This issue affects Res CVE-2026-394686.8Contributor Arbitrary File Deletion in Meta Box – WordPress Custom Fields Framework <= 5.11.1 versions.CVE-2026-394694.3Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Softaculous PageLayer pagelayer allows Retrieve CVE-2026-394707.2Shop manager Privilege Escalation in WooCommerce Cart Abandonment Recovery < 2.1.0 versions.CVE-2026-394717.2Author PHP Object Injection in ShortPixel Image Optimizer <= 6.4.3 versions.CVE-2026-394727.2Shop manager PHP Object Injection in WooCommerce PDF Invoices & Packing Slips < 5.9.0 versions.