CVE-2026-94459: IRISPowerscan Default accounts with predictable credentials
IRISPowerscan contain default user accounts with predictable credentials. An unauthenticated attacker with access to an affected installation could use these credentials to authenticate to the application and access functionality available to the affected accounts, potentially resulting in unauthorised access or modification of application data and configuration.
Event History
Frequently Asked Questions
Who is exposed to this issue?
Any IRISPowerscan installation reachable by an unauthenticated attacker is exposed if the affected default accounts are present and retain predictable credentials. Network-adjacent access is reflected in the advisory’s attack vector.
What does an attacker need to exploit it?
An attacker needs access to an affected installation and can authenticate using the predictable default credentials. No prior authentication or user interaction is required.
What could an attacker do after exploiting the issue?
The attacker could access functionality available to the affected accounts. This could result in unauthorized access to, or modification of, application data and configuration.