CVE-2026-49007

HighCVSS 7.5/10Last modified Oct 24, 2026

Description

By accessing unencrypted information in the device firmware, an attacker can obtain the initial login credentials for the device's web interface.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-798

Affected software

No affected versions have been published.

Timeline

Published
Aug 7, 2026
Last modified
Oct 24, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-490086.5By accessing unencrypted information in the device firmware, an attacker can obtain credentials related to the integrity verification of a sCVE-2026-490093.1Northern.tech Mender Server v4.1.0, v4.0.1 and below, and fixed in v4.1.1 and v4.0.2 allows Directory Traversal.CVE-2026-49016.5AlanWeb SCADA saves sensitive information into a log file. Critically, user credentials are logged allowing the attacker to obtain further aCVE-2026-490147.8In GDAL 3.1.0 through 3.13.0, scanForGeometryContainers in the netCDF driver allows code execution via a stack-based buffer overflow. It reaCVE-2026-490176.5In OpenStack Swift before 2.36.2 and 2.37.2, s3api middleware enters an infinite loop when processing a truncated aws-chunked PUT request boCVE-2026-49028.8A vulnerability was detected in Tenda AC5 15.03.06.47. This affects the function fromAddressNat of the file /goform/addressNat of the componCVE-2026-49038.8A flaw has been found in Tenda AC5 15.03.06.47. This vulnerability affects the function formQuickIndex of the file /goform/QuickIndex of theCVE-2026-490337.8The application contains a stack-based buffer overflow vulnerability that can be exploited by an attacker to execute arbitrary code.CVE-2026-490358.1The affected product is vulnerable to a heap-based buffer overflow via a crafted MMS Initiate request. Remote code execution (RCE) has been CVE-2026-49048.8A vulnerability has been found in Tenda AC5 15.03.06.47. This issue affects the function formSetCfm of the file /goform/setcfm of the componCVE-2026-490427.3Improper Input Validation vulnerability in Apache Camel. This issue affects Apache Camel: from 4.8.0 through 4.18.2, from 4.19.0 through 4.CVE-2026-490434.7Unauthenticated Cross Site Request Forgery (CSRF) in WP Migrate Lite <= 2.7.8 versions.
CVE-2026-49007: High severity, CVSS 7.5 | Vulnix