This vulnerability (CVE-2026-35075) involves the use of a default, hard-coded password embedded in the firmware of MBS Single-A devices. An unauthenticated remote attacker can recover this password by analyzing the firmware image, thereby gaining full administrative access to the device. The vulnerability does not require any privileges or user interaction and has a high impact on confidentiality, integrity, and availability. No vendor advisory or patch information is currently available, and the affected versions have not been specified.

Successful exploitation allows an unauthenticated remote attacker to fully compromise affected MBS Single-A devices by recovering and using a default hard-coded password. This leads to complete control over the device, potentially compromising all data and functionality. The vulnerability scores 9.3 on CVSS 4.0, reflecting critical severity with high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, organizations should consider restricting access to affected devices, monitoring for unauthorized access attempts, and applying any vendor-recommended mitigations once available.