CVE Watch1 oct 2026

CVE-2026-103548

Improperly stored passwords in the config file in Itron MV-90 xi 3.0 allows attackers to decode the passwords and password histories to gain

CVSS

—

Sin CVSS

EPSS

0.1%

KEV

—

Exploit Today

0-100

Publicado: 30 sept 2026 · Última mod.: 1 oct 2026 · CWE-257 · CWE-260 · CWE-261

EPSS · 30d

0.1%EPSS · 30 días0.1%

2026-10-012026-10-19

Descripción técnica

Improperly stored passwords in the config file in Itron MV-90 xi 3.0 allows attackers to decode the passwords and password histories to gain access to the MV-90 application as any user.

Referencias oficiales

github.comhttps://github.com/PaloAltoNetworks/u42-vulnerability-disclosures/commits/main/2026/PANW-2026-0002/PANW-2026-0002.md

CVEs relacionados

CVECVSSEPSSKEVRExplotTítuloVis.

CVE-2026-287457.5 ALT

11.4%

——3Usernames and passwords, including the default credentials, are stored in the configuration file using weak encryption. If the default credentials are known by a malicious user, they could obtain other credentials on the system.9d CVE-2026-735896.3 MED

0.2%

——0Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, Versions prior to 5.36, contains a Weak Encoding for Password vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information disclosure, Information tampering, Protection mechanism bypass, and Unauthorized access.25d CVE-2026-692976.5 MED

57.2%

——17Storing passwords in a recoverable format in Windows DHCP Server allows an authorized attacker to disclose information over a network.26d CVE-2026-801764.7 MED

1.2%

——0Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains a Plaintext Storage of a Password vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to information disclosure.34d CVE-2026-634247.3 ALT

2.5%

——1During an internal security assessment, an improperly protected key was discovered in Lenovo Dock Manager that could allow a local authenticated user to escalate privileges.40d CVE-2026-653097.5 ALT

14.7%

——4ANDRITZ HIPASE-250 (formerly 250 SCALA) in affected versions stores and transmits user passwords using a reversible format instead of a one-way password hash. This allows an attacker able to read the credential store or capture network traffic to recover all stored passwords.53d