CVE-2026-35075: Hardcoded default Password for Service Account

Synopsis

This is an authentication bypass via hardcoded credentials affecting the MBS firmware product line (Single-A, Double-A Profibus, Double-A x-link, Single-X, Double-X CAN, Double-X DALI, Double-X KNX, and Double-X LON variants), all versions from V1_0_0_0 up to but not including V6_0_0_7. The vulnerability is reachable over the network without any prior authentication: an attacker extracts the hardcoded default service account password from a firmware image and uses it to log in remotely. Successful exploitation gives the attacker full administrative access to affected devices, with high-impact read, write, and availability control over the device itself. A patched-image rebuild at V6_0_0_7 is available on HarborGuard for environments running an affected firmware version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be able to reach the affected device service over the network; the CVSS vector specifies AV:N, meaning no local or physical access is required.

• AuthenticationNot required

  No credentials are needed before exploitation; the attacker recovers the hardcoded password from the firmware image and uses it to authenticate, so there is no effective authentication barrier (PR:N).

• Victim interactionNot required

  The attack is fully remote and automated; no user or administrator of the target device needs to take any action (UI:N).

• Attack complexityDetail

  Attack complexity is low (AC:L), meaning the exploit is straightforward and repeatable without relying on race conditions, specific memory layouts, or other environmental factors.

Blast Radius

• An attacker gains full administrative access to the targeted device, reading all stored configuration, credentials, and operational data on the device.
• The attacker can write or modify device configuration and operational state, including altering building-automation or industrial-control parameters depending on the device role.
• The attacker can disrupt or deny availability of the affected device, taking it offline or rendering it non-functional.
• All MBS device variants from V1_0_0_0 onward are affected, so a single recovered password applies uniformly across the entire affected product family.