CVE-2026-47116: LTSecurity LTK3500SF Hard-coded Credentials via Telnet/SSH
LTSecurity LTK3500SF contains a hard-coded credentials vulnerability where root and guest account passwords are stored as reversible hashes in /etc/shadow, recoverable using dictionary-based cracking tools. Attackers can use the recovered credentials to authenticate via Telnet or SSH and obtain full root-level access to the operating system.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to exploitation?
Any LTSecurity LTK3500SF device with Telnet or SSH reachable by an attacker is exposed. Exploitation does not require prior authentication or user interaction.
What does an attacker need to exploit this issue?
An attacker needs network access to the device's Telnet or SSH service and the ability to recover the reversible root or guest password hashes using dictionary-based cracking tools. The recovered root credentials provide full operating-system access.
How can I determine whether a device may be affected?
Confirm that the device is an LTSecurity LTK3500SF and determine whether Telnet or SSH is enabled or reachable. The vulnerable credential material is stored in /etc/shadow as reversible hashes for the root and guest accounts.