CVE-2026-49005
LowCVSS 2.4Exploitation Probability (EPSS)
Low risk2th percentile - higher than 2% of all known CVEs
Summary
The root password hash of the device can be obtained through unencrypted information in the firmware.
Risk Assessment
The risk includes the possibility of an attacker obtaining the root password, potentially leading to full control of the device.
Recommendation
It is recommended to change the root password to a unique and strong one and update the firmware if a patch is available.
Other vulnerabilities in Device firmware
See all- CVE-2026-27564High
A high-privileged remote attacker can exploit a command injection vulnerability in the /api/datastorage/data endpoint by sending a PUT request with admin credentials, allowing execution of commands with root privileges on the device.
- CVE-2026-27563High
A high-privileged remote attacker can exploit a command injection vulnerability in the /api/datastorage/data endpoint by sending a crafted GET request with admin credentials, allowing execution of commands with root privileges on the device.
- CVE-2026-27562High
A high-privileged remote attacker can exploit a command injection vulnerability in the /api/iodd/config endpoint by sending a crafted PUT request with admin credentials, allowing execution of commands with root privileges on the device.
- CVE-2026-27561High
A high-privileged remote attacker can exploit a command injection vulnerability in the /api/iodd/config endpoint by sending a crafted GET request with admin credentials, allowing execution of commands with root privileges on the device.
- CVE-2026-27560High
A high-privileged remote attacker can exploit a command injection vulnerability in the /api/status/data endpoint by sending a crafted DELETE request with admin credentials, allowing execution of commands with root privileges on the device.
- CVE-2026-49008Medium
By accessing unencrypted information in the device firmware, an attacker can obtain credentials related to the integrity verification of a specific application function on the device.
- CVE-2026-49007High
Vulnerability allowing access to unencrypted information in the device firmware, enabling an attacker to obtain the initial login credentials for the device's web interface.
- CVE-2026-49006Medium
By accessing unencrypted information in the device firmware, an attacker can obtain credentials related to TLS transmission.
- CVE-2026-50210High
The device encrypts data using AES-CBC with static zero-filled Initialization Vectors (IVs), making it susceptible to replay attacks and known-plaintext decryption.
- CVE-2025-41696Medium
An attacker can use an undocumented UART port on the PCB as a side-channel with the user hardcoded credentials obtained from CVE-2025-41692 to gain read access to parts of the filesystem of the device.
Original NVD description (English source)
The root password hash of the device can be obtained through unencrypted information in the firmware.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS