{"id":"CVE-2026-39460","published":"2026-10-09T15:17:14.660","lastModified":"2026-10-12T23:17:37.760","description":"Usernames and passwords, including the default factory credentials, are stored in plaintext within the configuration file. With administrator rights, the configuration file can be viewed through the CLI or they can be exported from the device through a TFTP transfer from the web interface. A TFTP transfer can be initiated through SNMP which does not require authentication.","cvssScore":8.1,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","cwes":["CWE-522"],"vendors":[],"products":[],"references":[{"url":"https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-281-01.json","tags":[]},{"url":"https://www.cisa.gov/news-events/ics-advisories/icsa-26-281-01","tags":[]},{"url":"https://www.hms-networks.com/","tags":[]},{"url":"https://www.hms-networks.com/cybersecurity","tags":[]}],"exploitRefs":[{"url":"https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-281-01.json","tags":[]}],"hasPoc":true,"ai":{"summary":"The vulnerability allows attackers to extract plaintext usernames and passwords from configuration files, including default factory credentials, through TFTP transfers initiated via SNMP without authentication. This creates a high-impact exposure where credentials can be easily harvested by anyone with network access.","exploitability":"Exploitation is relatively easy requiring only network access to initiate SNMP-based TFTP transfers, with no authentication required for the TFTP transfer initiation, allowing attackers to extract configuration files containing plaintext credentials.","blast_radius":"The impact could be significant across multiple devices that store credentials in plaintext and allow unauthenticated TFTP transfers, potentially exposing default factory credentials and administrative accounts across an entire network segment.","remediation":"Disable SNMP-based TFTP transfer functionality or restrict access to the affected configuration interface to authenticated users only, as no specific fixed version is mentioned in the description.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["credential-exposure","snmp","tftp","configuration-file"],"model":"garnet-coder","analyzedAt":"2026-10-17T08:58:34.852Z"}}