CVE-2026-47116

Deferred Deferred - Pending Action

Hard-Coded Credentials in LTK3500SF Firmware

Publication date: 2026-09-22

Last updated on: 2026-09-23

Assigner: VulnCheck

Description

LTSecurity LTK3500SF contains a hard-coded credentials vulnerability where the root and guest account passwords are stored in /etc/shadow as weak hashes recoverable with dictionary-based cracking tools. The recovered credentials authenticate against the device's Telnet and SSH services and grant root-level access to the operating system. These services are not confirmed to start automatically at boot, so exploitation requires Telnet or SSH to be running, whether enabled by the device configuration or started manually.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-22

Last Modified

2026-09-23

Generated

2026-10-13

AI Q&A

2026-09-22

EPSS Evaluated

2026-10-12

NVD

CVE-2026-47116

EUVD

EUVD-2026-84683

Affected Vendors & Products

Vendor	Product	Version / Range
ltsecurity	ltk3500sf	ac3f_v1.1.0_build191121
ltsecurity	ltk3500sf	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-798	The product contains hard-coded credentials, such as a password or cryptographic key.

Attack-Flow Graph

Executive Summary

LTSecurity LTK3500SF has a hard-coded credentials vulnerability where root and guest account passwords are stored as reversible hashes in /etc/shadow. Attackers can crack these hashes using dictionary-based tools to recover the passwords and gain full root-level access via Telnet or SSH.

Detection Guidance

Check if the device is running affected firmware versions LTK3500SF <= AC3F_V1.1.0_build191121. Inspect /etc/shadow for MD5 hashes of root and guest accounts. Use commands like 'cat /etc/shadow' to view hashes. Test credentials via Telnet or SSH with common passwords like '12345'.

Impact Analysis

An attacker could exploit this to gain full administrative control over the device, potentially leading to data theft, unauthorized system modifications, or further network compromise. The vulnerability allows remote access via Telnet or SSH without requiring user interaction.

Compliance Impact

This vulnerability likely violates compliance requirements for data protection and access control, such as GDPR's security principles or HIPAA's safeguards for protected health information. Unauthorized access risks data breaches, leading to potential legal and regulatory penalties.

Mitigation Strategies

Update firmware to a patched version if available. Disable Telnet and SSH access if not required. Change default passwords for root and guest accounts to strong, unique values. Restrict network access to the device via firewalls.

Hi! I’m here to help you understand CVE-2026-47116. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70