by Kastro
Paper/Archive/CVE-2026-25803

CVE-2026-25803

denpiligrim 3dp-manager — 3DP-MANAGER Uses Hard-coded Credentials

EPSS 0.4%CVSS 9.8
critical.is priorityof 100
36
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 34.4.344 × 206.9No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

3DP-MANAGER is an inbound generator for 3x-ui. In version 2.0.1 and prior, the application automatically creates an administrative account with known default credentials (admin/admin) upon the first initialization. Attackers with network access to the application's login interface can gain full administrative control, managing VPN tunnels and system settings. This issue will be patched in version 2.0.2.

Affected

ProductAffectedFixed inSource
3dp-manager<= 2.0.1–CNA

Scores by source

GitHub_M (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refgithub.com/denpiligrim/3dp-manager/security/advisories/GHSA-5x57-h7cw-9jmwrefgithub.com/denpiligrim/3dp-manager/commit/f568de41de97dd1b70a963708a1ee18e52b9d248