CVE-2026-18191
Critical · 9.8CVSS
9.8
EPSS
0.7%
Published
Jul 29, 2026
CISA due date
—
The record
VIN-DS783E-E6 developed by Vacron has a Hidden Functionality vulnerability, allowing unauthenticated remote attackers to exploit a specific hidden function to obtain the administrator credentials of the device.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-118579 A weakness has been identified in D-Link DIR-505 1.10B02. CWE-912
- CVE-2026-114353 Hidden functionality (undocumented backdoor) in the root-privileged 'assistant' daemon in… CWE-912
- CVE-2026-15413 The Link Factory WordPress plugin is a backdoor. CWE-912
- CVE-2026-18844 The firmware of the Pulsetto Vagus Nerve Stimulator accepts several undisclosed commands… CWE-912
- CVE-2026-17032 Multiple Supsystic Pro plugins were distributed with malicious code through the vendor's… CWE-912
- CVE-2026-14812 The Premium SEO WordPress plugin is malicious: it ships an unauthenticated backdoor that… CWE-912
- CVE-2026-11976 The official MonsterInsights Pro update distribution bucket… CWE-912
- CVE-2026-61515 Puwell IP Camera firmware versions 2.x through 4.x contains an unauthenticated command… CWE-912