This vulnerability involves the use of a default, hard-coded password embedded in the firmware of MBS Single-A devices (version V1_0_0_0). An attacker with remote access can recover this password from the firmware image without authentication, thereby gaining full control over the device. The CVSS 4.0 base score is 9.3, reflecting the ease of exploitation and the high impact on confidentiality, integrity, and availability. The vulnerability is categorized under CWE-1393 (Use of Default Password). No patch or official remediation level has been provided by the vendor, and the product is not a cloud service, so remediation depends on vendor updates or device replacement.

Successful exploitation allows an unauthenticated remote attacker to fully compromise affected MBS Single-A devices by leveraging a default hard-coded password. This leads to complete loss of confidentiality, integrity, and availability of the device and potentially the network it is connected to. The vulnerability is critical due to the lack of required privileges or user interaction and the high impact on all security properties.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix is currently available, users should monitor vendor communications for updates. Until a fix is provided, consider restricting network access to affected devices and replacing devices if possible to mitigate risk.