CVE-2026-85147
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
SmartIT Desktop Manager developed by Lightstar has a Use of Hard-coded Credentials vulnerability. Unauthenticated remote attackers can obtain a specific password from the source code, which can be used to retrieve the AES encryption key used for communication.
Risk Assessment
An unauthenticated attacker could intercept and decrypt communication, leading to confidentiality breach of data transmitted between client and server.
Recommendation
Immediately change hard-coded credentials, enforce key rotation, and implement a secure secrets management mechanism.
Other vulnerabilities in SmartIT Desktop Manager
See all- CVE-2026-85148Critical
SmartIT Desktop Manager developed by Lightstar has a Use of Hard-coded Credentials vulnerability. Unauthenticated remote attackers can exploit a fixed password to remotely access user hosts.
- CVE-2026-85146Critical
SmartIT Desktop Manager developed by Lightstar has a Use of Hard-coded Credentials vulnerability. Unauthenticated remote attackers can obtain the SSH service account credentials and passwords for the SmartIT Agent directly from the application source code.
- CVE-2026-85149Medium
SmartIT Desktop Manager developed by Lightstar has a Use of Hard-coded Credentials vulnerability. Unauthenticated remote attackers can obtain the SFTP service credentials of the SmartIT Agent application from the source code, thereby browsing the file system of the user's host.
Original NVD description (English source)
SmartIT Desktop Manager developed by Lightstar has a Use of Hard-coded Credentials vulnerability. Unauthenticated remote attackers can obtain a specific password from the source code, which can be used to retrieve the AES encryption key used for communication.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS