CVE-2026-73778: Credential Manager Vulnerability Allows Unauthorized Administrative Access
A vulnerability exists in the Credential Manager component that may allow for unauthorized administrative access. An unauthenticated remote attacker could exploit this vulnerability on a device in its factory-default or post-ZTP state before any administrator has configured credentials by providing a predictable factory-default password. Successful exploitation could result in full administrative control of the affected device during the initial setup process.
Affected Software
Event History
Frequently Asked Questions
Which devices are exposed to this issue?
Devices are exposed while they remain in a factory-default or post-ZTP state, before an administrator has configured credentials. The issue applies during the initial setup process.
What does an attacker need to exploit it?
An unauthenticated remote attacker must be able to target the device during its initial setup state and provide the predictable factory-default password. No prior credentials or user interaction are required.
What is the impact of successful exploitation?
Successful exploitation can give the attacker full administrative control of the affected device.