CVE-2026-18452

CriticalCVSS 10.0

Published: 31/07/2026(UTC)Updated: 31/07/2026(UTC)Translated: 31/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.43%

36th percentile - higher than 36% of all known CVEs

Summary

DMS+ (Non-Mobile) by Rich Source has a Use of Hard-coded Credentials vulnerability. Unauthenticated remote attackers can exploit a fixed API key to gain control over all installed DMS+ devices.

Risk Assessment

An attacker can gain full control over all DMS+ devices in the organization, potentially leading to data confidentiality and integrity breaches.

Recommendation

Immediately change the default API key to a unique one per device and implement multi-factor authentication mechanisms.

Original NVD description (English source)

DMS+ (Non-Mobile) developed by Rich Source has a Use of Hard-coded Credentials vulnerability. Unauthenticated remote attackers can exploit a fixed API key to gain control over all installed DMS+ devices.