EIP-2026-101713

This writeup describes a backdoor account vulnerability in Eltek SmartPack where predefined user credentials are exposed in JSON files accessible via unauthenticated HTTP requests. The credentials are hashed with MD5, which can be cracked to obtain plaintext passwords.