CVE-2026-103548
Improperly stored passwords in the config file in Itron MV-90 xi 3.0 allows attackers to decode the passwords and password histories to gain
CVSS
—
No CVSS
EPSS
0.1%
p1
KEV
—
Exploit Today
0
0-100
Published: Sep 30, 2026 · Last modified: Oct 1, 2026 · CWE-257 · CWE-260 · CWE-261
0.1%EPSS · 30 days0.1%
2026-10-012026-10-19
Improperly stored passwords in the config file in Itron MV-90 xi 3.0 allows attackers to decode the passwords and password histories to gain access to the MV-90 application as any user.
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-287457.5 HIG11.4%
——3Usernames and passwords, including the default credentials, are stored in the configuration file using weak encryption. If the default credentials are known by a malicious user, they could obtain other credentials on the system.9dCVE-2026-735896.3 MED0.2%
——0Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, Versions prior to 5.36, contains a Weak Encoding for Password vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information disclosure, Information tampering, Protection mechanism bypass, and Unauthorized access.25dCVE-2026-692976.5 MED57.2%
——17Storing passwords in a recoverable format in Windows DHCP Server allows an authorized attacker to disclose information over a network.26dCVE-2026-801764.7 MED1.2%
——0Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains a Plaintext Storage of a Password vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to information disclosure.34dCVE-2026-634247.3 HIG2.5%
——1During an internal security assessment, an improperly protected key was discovered in Lenovo Dock Manager that could allow a local authenticated user to escalate privileges.40dCVE-2026-653097.5 HIG14.7%
——4ANDRITZ HIPASE-250 (formerly 250 SCALA) in affected versions stores
and transmits user passwords using a reversible format instead of a
one-way password hash. This allows an attacker able to read the
credential store or capture network traffic to recover all stored
passwords.53d