CVE-2026-22109

UNKNOWN

Published 2026-10-30 · Source csirt@divd.nl

Description

The shipped WebUI template database retains the factory default passwords for all five account types in cleartext. Defaults are identical across devices and were unchanged on the tested unit.

CWE-1392

References

View on NVD

Related CVEs

Same severity, most recent

CVE-2026-110972
Płatnik performs client-side authentication. An attacker with access to any application instance connected to the backend server can bypass the login verification process and authenticate as an arbitrary user. This issue was fixed in metric 242 in version 10.02.002.
2026-10-30 · score —
CVE-2026-110971
Use of a weak password encoding algorithm in Płatnik software allows a user who obtains encoded password to easily decode it. This issue was fixed in metric 242 in version 10.02.002.
2026-10-30 · score —
CVE-2026-110970
Płatnik uses HTTP protocol to download updates, libraries and support files. It allows an attacker to conduct a Man-In-The-Middle attack, obtain transmitted data and replace the original files with their own. This issue was fixed in metric 242 in version 10.02.002.
2026-10-30 · score —
CVE-2026-105924
A NULL pointer dereference vulnerability in the Qt QCborValue to JSON conversion of the Qt Core module.
2026-10-30 · score —
CVE-2025-68395
ARKETEAM Protectel modules PROTECTELMAJ and BDF contain a note editor module vulnerable to Stored XSS. A low privileged attacker can inject arbitrary HTML and JS into notes, which will be rendered/executed when a user visits this module. This issue has been fixed in: PROTECTELMAJ v6.5.19 and BDF v6.4.67
2026-10-30 · score —