CVE-2026-31928

HighCVSS 8.1

Published: 26/06/2026(UTC)Updated: 06/07/2026(UTC)Translated: 07/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.45%

36th percentile - higher than 36% of all known CVEs

Summary

DMP-5000 devices are shipped with a default administrative web account that has weak authentication controls and is not required to be changed during initial setup or operation. Using these accounts provides full system access.

Risk Assessment

The risk is that an attacker can exploit default credentials to gain unauthorized full access to the device, potentially leading to network compromise and data breach.

Recommendation

Immediately change default administrative passwords to strong, unique passwords and enforce a policy requiring default credential changes during initial configuration.

Other vulnerabilities in DMP-5000

CVE-2026-33560High
The DMP-5000 file service exposes authenticated arbitrary file upload functionality without validation. No file extension filtering or content inspection is enforced, allowing executable binaries and scripts to be accepted and written directly to the server.

Original NVD description (English source)

The DMP-5000 devices are shipped with a default administrative web account with weak authentication controls, which are not required to be changed during initial configuration or operation. Using these accounts provides full system access.