CVE-2026-18191 identifies a hidden functionality vulnerability in the Vacron VIN-DS783E-E6 device. This flaw permits unauthenticated remote attackers to exploit a specific hidden function to retrieve administrator credentials, potentially leading to full administrative control of the device. The vulnerability is classified under CWE-912 (Hidden Functionality) and has a CVSS 4.0 base score of 9.3, reflecting network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, and availability. No vendor advisory or patch information is provided, and the device is not a cloud service.

Successful exploitation allows unauthenticated remote attackers to obtain administrator credentials, which can lead to complete compromise of the affected device. This poses a critical security risk as attackers gain full control without needing prior access or interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict network access to the device where possible and monitor for unauthorized access attempts.