CVE-2026-39460
Received Received - Intake

Plaintext Credential Storage in Milesight AIOT Camera Firmware

Publication date: 2026-10-09

Last updated on: 2026-10-09

Assigner: ICS-CERT

Description
Usernames and passwords, including the default factory credentials, are stored in plaintext within the configuration file. With administrator rights, the configuration file can be viewed through the CLI or they can be exported from the device through a TFTP transfer from the web interface. A TFTP transfer can be initiated through SNMP which does not require authentication.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-09
Last Modified
2026-10-09
Generated
2026-10-09
AI Q&A
2026-10-09
EPSS Evaluated
N/A
NVD
CVE-2026-39460
EUVD
EUVD-2026-95805

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
Red Lion Controls 700 Series 0
Red Lion Controls 700 Series 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-522 The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves plaintext storage of usernames and passwords, including default factory credentials, in a configuration file. Attackers with administrator rights can access these credentials via the CLI or by exporting the file through a TFTP transfer from the web interface. Notably, TFTP transfers can be initiated via SNMP without authentication.

Detection Guidance

Check configuration files for plaintext storage of usernames and passwords. Review CLI access logs for unauthorized TFTP transfers or SNMP requests. Inspect network traffic for unusual TFTP or SNMP activity.

Impact Analysis

An attacker could gain unauthorized access to the system by retrieving stored credentials. This could lead to data breaches, unauthorized configuration changes, or control over the device. The lack of authentication for SNMP-initiated TFTP transfers further increases the risk of exploitation.

Compliance Impact

This vulnerability likely violates compliance requirements for data protection and security, such as GDPR and HIPAA, due to the storage of plaintext credentials. It exposes sensitive data, potentially leading to unauthorized access and data leaks, which are major compliance violations.

Mitigation Strategies

Disable plaintext credential storage in configuration files. Restrict CLI and web interface access to authorized users only. Disable TFTP transfers and SNMP write access. Rotate all default and stored credentials immediately.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-39460. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart