CVE-2026-18452: CWE-798 Use of Hard-coded Credentials in Rich Source DMS+ (Non-Mobile)
DMS+ (Non-Mobile) by Rich Source contains a critical vulnerability involving the use of hard-coded credentials. This flaw allows unauthenticated remote attackers to exploit a fixed API key to gain control over all installed DMS+ devices. The vulnerability is identified as CWE-798 and has a CVSS 4.0 base score of 10. No patch or remediation guidance is currently available from the vendor.
AI Analysis
Technical Summary
The Rich Source DMS+ (Non-Mobile) product has a Use of Hard-coded Credentials vulnerability (CWE-798) identified as CVE-2026-18452. This vulnerability enables unauthenticated remote attackers to leverage a fixed API key embedded in the product to take control of all installed devices running DMS+. The CVSS 4.0 score is 10, indicating critical severity with network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, availability, and security requirements. No vendor advisory or patch information is provided, and the product is not a cloud service.
Potential Impact
Exploitation of this vulnerability allows unauthenticated remote attackers to fully control all installed DMS+ (Non-Mobile) devices by using a hard-coded API key. This compromises confidentiality, integrity, and availability of the affected systems, potentially leading to complete system takeover.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround is currently documented. Until a patch is available, restrict network access to DMS+ devices and monitor for unauthorized access attempts.
CVE-2026-18452: CWE-798 Use of Hard-coded Credentials in Rich Source DMS+ (Non-Mobile)
Description
DMS+ (Non-Mobile) by Rich Source contains a critical vulnerability involving the use of hard-coded credentials. This flaw allows unauthenticated remote attackers to exploit a fixed API key to gain control over all installed DMS+ devices. The vulnerability is identified as CWE-798 and has a CVSS 4.0 base score of 10. No patch or remediation guidance is currently available from the vendor.
CVSS v4.0
Score 10.0critical
Affected software
Rich Source
DMS+ (Non-Mobile)
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Rich Source DMS+ (Non-Mobile) product has a Use of Hard-coded Credentials vulnerability (CWE-798) identified as CVE-2026-18452. This vulnerability enables unauthenticated remote attackers to leverage a fixed API key embedded in the product to take control of all installed devices running DMS+. The CVSS 4.0 score is 10, indicating critical severity with network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, availability, and security requirements. No vendor advisory or patch information is provided, and the product is not a cloud service.
Potential Impact
Exploitation of this vulnerability allows unauthenticated remote attackers to fully control all installed DMS+ (Non-Mobile) devices by using a hard-coded API key. This compromises confidentiality, integrity, and availability of the affected systems, potentially leading to complete system takeover.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround is currently documented. Until a patch is available, restrict network access to DMS+ devices and monitor for unauthorized access attempts.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- twcert
- Date Reserved
- 2026-07-31T05:43:34.083Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6a6c42b99c2644c7f86e86ab
Added to database: 07/31/2026, 06:37:45 UTC
Last enriched: 08/07/2026, 14:38:00 UTC
Last updated: 09/14/2026, 10:01:29 UTC
Views: 90
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.