cve-2026-47116

CRITICAL CVSS 9.8 opencve
Description

LTSecurity LTK3500SF contains a hard-coded credentials vulnerability where the root and guest account passwords are stored in /etc/shadow as weak hashes recoverable with dictionary-based cracking tools. The recovered credentials authenticate against the device's Telnet and SSH services and grant root-level access to the operating system. These services are not confirmed to start automatically at boot, so exploitation requires Telnet or SSH to be running, whether enabled by the device configuration or started manually.

Timeline
Published
2026-09-22 20:17 UTC
Last Modified
2026-09-23
CVSS Details

CVSS details not available.

Affected Products

No product information available.

Weaknesses (CWE)
CWE-798
CVSS metrics
Version Base Severity Vector Exploitability Impact Source
4.0 9.2 CRITICAL CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N mitre
3.1 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H mitre
4.0 9.2 CRITICAL CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X nvd
3.1 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H nvd
4.0 9.2 CRITICAL CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N opencve
3.1 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H opencve
References

No references available.

Linked Vulnerabilities

No linked vulnerabilities found.

{
  "cve": "CVE-2026-47116",
  "enrichment": {
    "affected": [
      {
        "configurations": [
          {
            "platform": null,
            "status": "affected",
            "versions": {
              "scheme": "generic",
              "value": "AC3F_V1.1.0_build191121"
            }
          }
        ],
        "enrichment": {
          "confidence": 100.0,
          "confidence_source": "cna",
          "scores": [
            {
              "score": 100.0,
              "source": "cna"
            }
          ]
        },
        "original": {
          "product": "LTK3500SF",
          "source": "cna",
          "vendor": "LTSecurity"
        },
        "product": "ltk3500sf",
        "vendor": "ltsecurity"
      }
    ],
    "created": "2026-09-22T20:45:16.786141+00:00",
    "updated": "2026-09-23T18:45:07.146162+00:00",
    "vendors": [
      "ltsecurity",
      "ltsecurity$PRODUCT$ltk3500sf"
    ]
  },
  "epss": {
    "score": 0.00512
  },
  "mitre": {
    "cpes": [],
    "created": "2026-09-22T19:19:49.449000+00:00",
    "description": "LTSecurity LTK3500SF contains a hard-coded credentials vulnerability where the root and guest account passwords are stored in /etc/shadow as weak hashes recoverable with dictionary-based cracking tools. The recovered credentials authenticate against the device's Telnet and SSH services and grant root-level access to the operating system. These services are not confirmed to start automatically at boot, so exploitation requires Telnet or SSH to be running, whether enabled by the device configuration or started manually.",
    "metrics": {
      "cvssV2_0": {},
      "cvssV3_0": {},
      "cvssV3_1": {
        "score": 9.8,
        "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
      },
      "cvssV4_0": {
        "score": 9.2,
        "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"
      }
    },
    "mitre_repo_path": "cves/2026/47xxx/CVE-2026-47116.json",
    "references": [
      "https://github.com/AndreaLandriscina/Hardcoded-Credentials-in-LTSecurity-LTK3500SF",
      "https://www.vulncheck.com/advisories/ltsecurity-ltk3500sf-hard-coded-credentials-via-telnet-ssh"
    ],
    "title": "LTSecurity LTK3500SF Hard-coded Credentials via Telnet/SSH",
    "updated": "2026-09-23T15:44:58.891000+00:00",
    "vendors": [],
    "weaknesses": [
      "CWE-798"
    ]
  },
  "nvd": {
    "cpes": [],
    "created": "2026-09-22T20:17:03.583000+00:00",
    "description": "LTSecurity LTK3500SF contains a hard-coded credentials vulnerability where the root and guest account passwords are stored in /etc/shadow as weak hashes recoverable with dictionary-based cracking tools. The recovered credentials authenticate against the device's Telnet and SSH services and grant root-level access to the operating system. These services are not confirmed to start automatically at boot, so exploitation requires Telnet or SSH to be running, whether enabled by the device configuration or started manually.",
    "metrics": {
      "cvssV2_0": {},
      "cvssV3_0": {},
      "cvssV3_1": {
        "score": 9.8,
        "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
      },
      "cvssV4_0": {
        "score": 9.2,
        "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
      }
    },
    "nvd_repo_path": "2026/CVE-2026-47116.json",
    "references": [
      "https://github.com/AndreaLandriscina/Hardcoded-Credentials-in-LTSecurity-LTK3500SF",
      "https://www.vulncheck.com/advisories/ltsecurity-ltk3500sf-hard-coded-credentials-via-telnet-ssh"
    ],
    "title": null,
    "updated": "2026-09-23T16:16:43.550000+00:00",
    "vendors": [],
    "weaknesses": [
      "CWE-798"
    ]
  },
  "opencve": {
    "changes": [
      {
        "created": "2026-09-22T19:30:00+00:00",
        "data": [
          {
            "details": {
              "new": "LTSecurity LTK3500SF contains a hard-coded credentials vulnerability where root and guest account passwords are stored as reversible hashes in /etc/shadow, recoverable using dictionary-based cracking tools. Attackers can use the recovered credentials to authenticate via Telnet or SSH and obtain full root-level access to the operating system.",
              "old": null
            },
            "type": "description"
          },
          {
            "details": {
              "new": "LTSecurity LTK3500SF Hard-coded Credentials via Telnet/SSH",
              "old": null
            },
            "type": "title"
          },
          {
            "details": {
              "added": [
                "CWE-798"
              ],
              "removed": []
            },
            "type": "weaknesses"
          },
          {
            "details": {
              "added": [
                "https://github.com/AndreaLandriscina/Hardcoded-Credentials-in-LTSecurity-LTK3500SF",
                "https://www.vulncheck.com/advisories/ltsecurity-ltk3500sf-hard-coded-credentials-via-telnet-ssh"
              ],
              "removed": []
            },
            "type": "references"
          },
          {
            "details": {
              "added": {
                "cvssV3_1": {
                  "score": 9.8,
                  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
                },
                "cvssV4_0": {
                  "score": 9.3,
                  "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"
                }
              },
              "removed": {},
              "updated": {}
            },
            "type": "metrics"
          }
        ],
        "id": "9ea719a9-7e79-4703-b70a-a4d5a2783e56"
      },
      {
        "created": "2026-09-23T12:30:00+00:00",
        "data": [
          {
            "details": [
              "ltsecurity",
              "ltsecurity$PRODUCT$ltk3500sf"
            ],
            "type": "first_time"
          },
          {
            "details": {
              "added": [
                "ltsecurity",
                "ltsecurity$PRODUCT$ltk3500sf"
              ],
              "removed": []
            },
            "type": "vendors"
          }
        ],
        "id": "241a0c10-85a1-4b24-a6c2-da789ea358d7"
      },
      {
        "created": "2026-09-23T15:30:00+00:00",
        "data": [
          {
            "details": {
              "added": {
                "ssvc": {
                  "options": {
                    "Automatable": "yes",
                    "Exploitation": "poc",
                    "Technical Impact": "total"
                  },
                  "version": "2.0.3"
                }
              },
              "removed": {},
              "updated": {}
            },
            "type": "metrics"
          }
        ],
        "id": "24789581-0bd5-4799-99c2-fa8071d0c4a6"
      },
      {
        "created": "2026-09-23T16:00:00+00:00",
        "data": [
          {
            "details": {
              "new": "LTSecurity LTK3500SF contains a hard-coded credentials vulnerability where the root and guest account passwords are stored in /etc/shadow as weak hashes recoverable with dictionary-based cracking tools. The recovered credentials authenticate against the device's Telnet and SSH services and grant root-level access to the operating system. These services are not confirmed to start automatically at boot, so exploitation requires Telnet or SSH to be running, whether enabled by the device configuration or started manually.",
              "old": "LTSecurity LTK3500SF contains a hard-coded credentials vulnerability where root and guest account passwords are stored as reversible hashes in /etc/shadow, recoverable using dictionary-based cracking tools. Attackers can use the recovered credentials to authenticate via Telnet or SSH and obtain full root-level access to the operating system."
            },
            "type": "description"
          },
          {
            "details": {
              "added": {},
              "removed": {},
              "updated": {
                "cvssV4_0": {
                  "new": {
                    "score": 9.2,
                    "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"
                  },
                  "old": {
                    "score": 9.3,
                    "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"
                  }
                }
              }
            },
            "type": "metrics"
          }
        ],
        "id": "d38d8537-e6dd-4d95-9e3e-e8fe4457b617"
      }
    ],
    "cpes": {
      "data": [],
      "providers": []
    },
    "created": {
      "data": "2026-09-22T19:19:49.449000+00:00",
      "provider": "mitre"
    },
    "description": {
      "data": "LTSecurity LTK3500SF contains a hard-coded credentials vulnerability where the root and guest account passwords are stored in /etc/shadow as weak hashes recoverable with dictionary-based cracking tools. The recovered credentials authenticate against the device's Telnet and SSH services and grant root-level access to the operating system. These services are not confirmed to start automatically at boot, so exploitation requires Telnet or SSH to be running, whether enabled by the device configuration or started manually.",
      "provider": "mitre"
    },
    "metrics": {
      "cvssV2_0": {
        "data": {},
        "provider": null
      },
      "cvssV3_0": {
        "data": {},
        "provider": null
      },
      "cvssV3_1": {
        "data": {
          "score": 9.8,
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
        },
        "provider": "mitre"
      },
      "cvssV4_0": {
        "data": {
          "score": 9.2,
          "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"
        },
        "provider": "mitre"
      },
      "epss": {
        "data": {
          "score": 0.00512
        },
        "provider": "first"
      },
      "kev": {
        "data": {},
        "provider": null
      },
      "ssvc": {
        "data": {
          "options": {
            "Automatable": "yes",
            "Exploitation": "poc",
            "Technical Impact": "total"
          },
          "version": "2.0.3"
        },
        "provider": "vulnrichment"
      },
      "threat_severity": {
        "data": null,
        "provider": null
      }
    },
    "references": {
      "data": [
        "https://github.com/AndreaLandriscina/Hardcoded-Credentials-in-LTSecurity-LTK3500SF",
        "https://www.vulncheck.com/advisories/ltsecurity-ltk3500sf-hard-coded-credentials-via-telnet-ssh"
      ],
      "providers": [
        "mitre",
        "nvd"
      ]
    },
    "title": {
      "data": "LTSecurity LTK3500SF Hard-coded Credentials via Telnet/SSH",
      "provider": "mitre"
    },
    "updated": {
      "data": "2026-09-23T15:44:58.891000+00:00",
      "provider": "mitre"
    },
    "vendors": {
      "data": [
        "ltsecurity",
        "ltsecurity$PRODUCT$ltk3500sf"
      ],
      "providers": [
        "enrichment"
      ]
    },
    "weaknesses": {
      "data": [
        "CWE-798"
      ],
      "providers": [
        "mitre",
        "nvd"
      ]
    }
  },
  "vulnrichment": {
    "cpes": [],
    "created": "2026-09-22T19:19:49.449000+00:00",
    "description": "LTSecurity LTK3500SF contains a hard-coded credentials vulnerability where the root and guest account passwords are stored in /etc/shadow as weak hashes recoverable with dictionary-based cracking tools. The recovered credentials authenticate against the device's Telnet and SSH services and grant root-level access to the operating system. These services are not confirmed to start automatically at boot, so exploitation requires Telnet or SSH to be running, whether enabled by the device configuration or started manually.",
    "metrics": {
      "cvssV2_0": {},
      "cvssV3_0": {},
      "cvssV3_1": {},
      "cvssV4_0": {},
      "kev": {},
      "ssvc": {
        "options": {
          "Automatable": "yes",
          "Exploitation": "poc",
          "Technical Impact": "total"
        },
        "version": "2.0.3"
      }
    },
    "references": [],
    "title": "LTSecurity LTK3500SF Hard-coded Credentials via Telnet/SSH",
    "updated": "2026-09-23T14:32:01.879000+00:00",
    "vendors": [],
    "vulnrichment_repo_path": "2026/47xxx/CVE-2026-47116.json",
    "weaknesses": []
  }
}
View JSON API Download JSON