CVE-2026-35075
Critical · 9.8CVSS
9.8
EPSS
0.6%
Published
Jun 3, 2026
CISA due date
—
The record
An unauthenticated remote attacker can recover a default, hard coded password from a firmware image and thus gain full access to all affected devices.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-112030 A vulnerability was found in diem-project diem up to 5.1.3. CWE-1393
- CVE-2026-69657 XING CPTrans-ME-X contains a Use of Default Password (CWE-1393). CWE-1393
- CVE-2026-82698 A vulnerability was detected in sambitraj Student-Management-System up to… CWE-1393
- CVE-2026-19851 A Use of Default Password vulnerability affecting Tuleap Enterprise Edition from 17.0… CWE-1393
- CVE-2026-16504 Deployment of the VPS.org one-click Zulip template deploys a hardcoded application… CWE-1393
- CVE-2026-16503 Deployment of the VPS.org one-click Supabase template deploys a PostgreSQL instance that… CWE-1393
- CVE-2026-54445 vantage6 is an open-source infrastructure for privacy preserving analysis. CWE-1393
- CVE-2026-8672 Use of default password vulnerability in syslink software AG Avantra on Linux, Windows… CWE-1393