CVE-2026-35075: Hardcoded default Password for Service Account
An unauthenticated remote attacker can recover a default, hard coded password from a firmware image and thus gain full access to all affected devices.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Remove the hardcoded default credential by configuring the device to use a unique, strong password for the service account or disable the service/account if it is not needed. Ensure the password is not stored in firmware or recoverable from the image.
Service account (firmware) default_password / hardcoded credential = replace hardcoded password with a unique, strong password or disable the account if not required - Compensating control
Restrict network access to the affected service and management interfaces (apply firewall rules, ACLs, or network segmentation) so only trusted administrative hosts can reach the service until the hardcoded credential is removed or changed.
- Operational
Rotate any credentials associated with the affected devices and service accounts (replace passwords, reissue keys/secrets) after removing or changing the hardcoded credential.
Event History
Frequently Asked Questions
Which software should be prioritized for review?
Mbs-solutions Universal Gateway Firmware is identified as affected.