CVE-2026-108584: Hard-coded Credentials in FunnyWolf Viper

This vulnerability in FunnyWolf Viper (versions 3.1.0 through 3.1.11) arises from hard-coded credentials embedded in an unknown function within the file /root/viper/.git/config. The flaw permits remote exploitation without authentication or user interaction, potentially allowing attackers to gain unauthorized access. The CVSS 4.0 base score is 6.9, indicating medium severity. Exploit code has been publicly released, which may facilitate attacks. No patch or remediation information is provided in the available data.

The presence of hard-coded credentials can allow remote attackers to access the affected system without authorization. Given the credentials are embedded in a configuration file, attackers may gain persistent access or escalate privileges depending on the system context. The availability of public exploit code increases the likelihood of exploitation. However, no evidence of active exploitation in the wild is currently known.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected file and monitor for unauthorized access attempts. Consider applying compensating controls such as network segmentation or credential rotation if possible.