CVE-2026-35075

CRITICAL

Hardcoded default Password for Service Account

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2026-35075 has a selected CVSS score of 9.3 (critical).

Description

An unauthenticated remote attacker can recover a default, hard coded password from a firmware image and thus gain full access to all affected devices.

Description source: CVE List

Exploitation context

CISA SSVC decision

ExploitationNone
AutomatableYes
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Jun 3, 2026 · Source: CVE List

Affected products and versions

Showing 12 of 18
ProductSourceVersion range

Double-A Profibus

Browse MBS / Double-A Profibus

Default status: unaffected

CVE ListV1_00_00 to < V6_00_07affected

Double-A x-link

Browse MBS / Double-A x-link

Default status: unaffected

CVE ListV1_00_00 to < V6_00_07affected

Double-X CAN

Browse MBS / Double-X CAN

Default status: unaffected

CVE ListV1_00_00 to < V6_00_07affected

Double-X DALI

Browse MBS / Double-X DALI

Default status: unaffected

CVE ListV1_00_00 to < V6_00_07affected

Double-X KNX

Browse MBS / Double-X KNX

Default status: unaffected

CVE ListV1_00_00 to < V6_00_07affected

Double-X LON

Browse MBS / Double-X LON

Default status: unaffected

CVE ListV1_00_00 to < V6_00_07affected

Double-X M-Bus

Browse MBS / Double-X M-Bus

Default status: unaffected

CVE ListV1_00_00 to < V6_00_07affected

Double-X PROFINET

Browse MBS / Double-X PROFINET

Default status: unaffected

CVE ListV1_00_00 to < V6_00_07affected

Double-X x-link

Browse MBS / Double-X x-link

Default status: unaffected

CVE ListV1_00_00 to < V6_00_07affected

Single-A

Browse MBS / Single-A

Default status: unaffected

CVE ListV1_00_00 to < V6_00_07affected

Single-X

Browse MBS / Single-X

Default status: unaffected

CVE ListV1_00_00 to < V6_00_07affected

Triple-X KNX+DALI

Browse MBS / Triple-X KNX+DALI

Default status: unaffected

CVE ListV1_00_00 to < V6_00_07affected

References

2