by Kastro
Paper/Archive/CVE-2026-85146

CVE-2026-85146

Lightstar SmartIT Desktop Manager — Lightstar｜SmartIT Desktop Manager - Use of Hard-coded Credentials

EPSS 0.6%CVSS 9.8
critical.is priorityof 100
39
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 50.2.502 × 2010.0No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

SmartIT Desktop Manager developed by Lightstar has a Use of Hard-coded Credentials vulnerability. Unauthenticated remote attackers can obtain the SSH service account credentials and passwords for the SmartIT Agent directly from the application source code.

Affected

ProductAffectedFixed inSource
SmartIT Desktop Manager≤ 10–CNA

Scores by source

twcert (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
twcert (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

writeuptwcert.org.tw/tw/cp-132-11176-a4cc2-1.htmlwriteuptwcert.org.tw/en/cp-139-11177-13ca3-2.html