CVE-2026-39460
Usernames and passwords, including the default factory credentials, are stored in plaintext within…
- Risk score
- 53/100
- CVSS
- 8.1 v3.1
- Exploit chance (30 days)
- 0.3%
- Published
- 9 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Usernames and passwords, including the default factory credentials, are stored in plaintext within the configuration file. With administrator rights, the configuration file can be viewed through the CLI or they can be exported from the device through a TFTP transfer from the web interface. A TFTP transfer can be initi…
- Affected
- See advisory
- Fix
- Apply the vendor's security update; see the linked advisory.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 8.1 high
References
Original description
Usernames and passwords, including the default factory credentials, are stored in plaintext within the configuration file. With administrator rights, the configuration file can be viewed through the CLI or they can be exported from the device through a TFTP transfer from the web interface. A TFTP transfer can be initiated through SNMP which does not require authentication.
Last activity 9 Oct 2026. Patch Forecast updates every hour.