CVE-2026-18931: CWE-798 Use of Hard-coded Credentials in TMT Machine Industry and Trade Ltd. Co. Talassoft Industrial Management Software

This vulnerability (CWE-798) in Talassoft Industrial Management Software arises from the use of hard-coded credentials embedded within the software. Such credentials can be extracted by attackers, leading to unauthorized access to sensitive data. The affected versions range from 4 to before 16. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) indicates network attack vector, low attack complexity, no privileges or user interaction required, with high confidentiality and integrity impact but no availability impact. No official patch or remediation level has been provided yet, and no known exploits are reported in the wild.

Exploitation of this vulnerability allows an unauthenticated attacker to retrieve embedded sensitive data by leveraging hard-coded credentials. This can lead to a complete compromise of confidentiality and integrity of the affected system's data. There is no impact on availability. The vulnerability can be exploited remotely without any privileges or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, limit exposure by restricting network access to the affected software and monitor for unauthorized access attempts. Avoid using affected versions in sensitive environments if possible.