CVE-2026-85147: CWE-284 Improper Access Control in Lightstar SmartIT Desktop Manager

The vulnerability identified as CVE-2026-85147 affects Lightstar's SmartIT Desktop Manager. It stems from the use of hard-coded credentials within the product's source code. Attackers without any privileges can obtain this password remotely, which then allows them to retrieve the AES encryption key used for securing communications. This represents a CWE-284 (Improper Access Control) weakness. The CVSS v4.0 base score is 8.7, indicating a high impact with network attack vector, no required privileges or user interaction, and high confidentiality impact. There is no vendor advisory or patch information available at this time.

The vulnerability allows unauthenticated remote attackers to obtain a hard-coded password and subsequently the AES encryption key used for communication. This compromises the confidentiality of communications protected by this encryption key. There is no indication of integrity or availability impact. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the affected product where possible and monitor for unauthorized access attempts. Avoid relying on the affected product for sensitive communications.