CVE-2026-96587CWE-798hardcoded-credentials

CVE-2026-96587

Critical · published September 30, 2026

CVSS v3.1
10.0
EPSS
0%
Percentile
26.7
In the wild
Unconfirmed
What it is

The Viidure Android application embeds permanent, plaintext cloud storage credentials within its compiled code. These credentials provide full access to critical platform storage, including the ability to read, modify, or delete operational files such as firmware and application binaries.

The record
Technical detail
CVSS v3.1
10.0 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
10.0 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
EPSS
0.00344 · 26.7th percentile
Weakness
CWE-798 · Use of Hard-coded Credentials
Published
2026-09-30T01:19Z
References (3)
https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-272-07.json · [email protected]https://viidure.app/ · [email protected]https://www.cisa.gov/news-events/ics-advisories/icsa-26-272-07 · [email protected]
EPSS history
Timeline
  • 01 OCT 03:50Z
    EPSS moved — → 0%
    epss
  • 29 SEP 20:42Z
    Use of Hard-coded Credentials in Viidure Dashcam Android Application
    cvelistv5