CVE-2026-22109: Default WebUI passwords stored in plaintext
Published Oct 30, 2026
·Updated
The shipped WebUI template database retains the factory default passwords for all five account types in cleartext. Defaults are identical across devices and were unchanged on the tested unit.
Event History
Oct 30, 2026
CVE Published
via MITRE·10:34 AM
Data Sourced
via MITRE·10:34 AM
RemedyDescriptionWeakness
Data Sourced
via NVD·11:17 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Who is exposed to this issue?
Devices using the shipped WebUI template database are exposed because it retains factory default passwords for all five account types in cleartext. The defaults are identical across devices and were unchanged on the tested unit.
2
What access does an attacker need to exploit this?
The vulnerability has a local attack vector and requires low privileges. No user interaction is required.
3
Does this affect a default configuration?
Yes. The issue concerns factory default WebUI passwords included in the shipped template database, and those defaults are identical across devices.