CVE-2026-39460

CVSS 9.3 (critical) · published 2026-10-09

Usernames and passwords, including the default factory credentials, are stored in plaintext within the configuration file. With administrator rights, the configuration file can be viewed through the CLI or they can be exported from the device through a TFTP transfer from the web interface. A TFTP transfer can be initiated through SNMP which does not require authentication.

Weakness: CWE-522

Source: NVD CVE-2026-39460

References

• https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-281-01.json
• https://www.cisa.gov/news-events/ics-advisories/icsa-26-281-01
• https://www.hms-networks.com/
• https://www.hms-networks.com/cybersecurity

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.