CVE-2026-9650
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
CWE-522 Insufficiently Protected Credentials vulnerability allows an unauthenticated attacker to access credentials stored in firmware or system files. This can lead to unauthorized access and exposure of sensitive information, and with physical access to the device, full compromise.
Risk Assessment
The risk is credential theft by an unauthenticated attacker, which combined with physical access to the device can result in complete system compromise and data breach.
Recommendation
Immediately update the firmware to a version that encrypts or securely stores credentials. Additionally, restrict physical access to devices and implement memory protection mechanisms.
Other vulnerabilities in Firmware
See all- CVE-2026-35075Critical
An unauthenticated remote attacker can recover a default, hard-coded password from a firmware image and gain full access to all affected devices.
- CVE-2026-44094High
An unauthenticated remote attacker can force the system to fall back to a firmware partition with an insecure configuration including default credentials. This could allow the attacker to gain SSH access to the system as an unprivileged user "user-app". Charging could be interrupted.
Original NVD description (English source)
CWE-522 Insufficiently Protected Credentials vulnerability that could cause unauthorized access and exposure of sensitive information when unauthenticated attacker accesses credentials stored within firmware or system files. With this credential an attacker could subsequently compromise the device if they have physical access to the device.