CVE-2026-66890
CriticalCVSS 9.6Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
The affected products use hard-coded credentials, which could allow remote access to files with root privileges where FTP is reachable. Technical details were not provided in the description.
Risk Assessment
An attacker who knows the embedded credentials can gain access to files with root privileges via FTP. This may lead to full system takeover and data leakage.
Recommendation
Apply the vendor patch that removes the hardcoded credentials or allows them to be changed. Until patched, disable the FTP service or restrict network access to it.
Other vulnerabilities in Nieokreślony
See all- CVE-2026-76646High
A remote attacker could cause excessive resource consumption by supplying specially crafted request parameters, potentially resulting in a denial of service condition. Older unsupported versions may also be affected.
- CVE-2026-68491Critical
An insufficient check allowed for the overwrite of arbitrary files via a symlink. Technical details were not provided in the description.
- CVE-2026-66887Critical
The affected products are missing authorization on state-changing CGIs and session checks are not performed. Technical details were not provided in the description.
Original NVD description (English source)
The affected products use hard-coded credentials, which could allow remote access to files with root privileges where FTP is reachable.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS