CVE-2026-47116 json
LTSecurity LTK3500SF Hard-coded Credentials via Telnet/SSH
published 2026-09-22 47 d ago modified 2026-09-24 45 d ago also EUVD-2026-84683
- cvss
- 9.8
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.5%
- EPSS 0.5% chance of exploitation in 30 days, percentile 43%
- public exploits
- 0
- none known
Summary
LTSecurity LTK3500SF contains a hard-coded credentials vulnerability where the root and guest account passwords are stored in /etc/shadow as weak hashes recoverable with dictionary-based cracking tools. The recovered credentials authenticate against the device's Telnet and SSH services and grant root-level access to the operating system. These services are not confirmed to start automatically at boot, so exploitation requires Telnet or SSH to be running, whether enabled by the device configuration or started manually.
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- yes
- Technical impact
- total
- Assessed
- 47 d ago
Exploit prediction
0.51% chance of exploitation in the next 30 days, higher than 43% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- github.com https://github.com/AndreaLandriscina/Hardcoded-Credentials-in-LTSecurity-LTK3500SF referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 9.2 | CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N |
| CNA | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| CNA | 4.0 | 9.2 | CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Affected products
- LTSecurity LTK3500SF
Classification
- Weakness
-
- CWE-798 Use of Hard-coded Credentials
References
-
github.com
/AndreaLandriscina/Hardcoded-Credentials-in-LTSecurity-LTK3500SF
technical-description, exploit
-
vulncheck.com
/advisories/ltsecurity-ltk3500sf-hard-coded-credentials-via-telnet-ssh
third-party-advisory
Sources
- CVE List CVE-2026-47116
- NVD CVE-2026-47116
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.