The vulnerability identified as CVE-2026-103548 affects Itron MV-90 xi version 3.0. It involves the improper storage of passwords in the configuration file, where passwords and password histories are stored in a recoverable format. This weakness allows an attacker with local access and low privileges to decode these passwords and escalate access to the application as any user. The CVSS 4.0 vector indicates local attack vector, low attack complexity, no user interaction, and partial confidentiality, integrity, and availability impacts.

An attacker with local access and low privileges can decode stored passwords and password histories from the configuration file, enabling unauthorized access to the MV-90 xi application as any user. This compromises user credentials and potentially the integrity and confidentiality of the application environment.

No official patch or remediation is currently documented. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict local access to systems running MV-90 xi 3.0 and monitor for unauthorized access attempts.