A critical hard-coded credentials flaw (CVSS 9.8) in the LTSecurity LTK3500SF lets unauthenticated attackers recover built-in account passwords and log in over Telnet or SSH with full root access.
What Is It
CVE-2026-47116 is a hard-coded credentials vulnerability (CWE-798) in the LTSecurity LTK3500SF. The device ships with built-in root and guest accounts whose password hashes are embedded in the firmware's /etc/shadow file. Those hashes are one-way, but they are weak enough to be recovered offline with standard dictionary-based cracking tools. Once cracked, the resulting credentials authenticate directly against the device's Telnet or SSH services and yield full root-level access to the underlying operating system.
The CVE was published 2026-09-22 and assigned by VulnCheck ([email protected]). It currently carries an NVD status of "Received."
Why It Matters
The CVSS v3.1 base score is 9.8 (CRITICAL), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. A CVSS v4.0 score of 9.3 (CRITICAL) was also assigned. Every exploitability dimension is maximally favorable to an attacker: network attack vector, low complexity, no privileges required, and no user interaction. Impact is HIGH across confidentiality, integrity, and availability.
Because the credentials are baked into the firmware image, they are likely identical across deployed units running the affected build, though neither the NVD record nor the advisory confirms this explicitly. If that holds, recovering them once on a single device, or from a publicly available firmware image, would produce a working root login for every unit on the same build. Remote management over Telnet or SSH appears to be the intended exposure path, so no chained bug or local access would be needed.
CISA KEV does not list this CVE, so there is no confirmed active exploitation at this time.
What's Vulnerable
- Vendor: LTSecurity
- Product: LTK3500SF
- Affected version:
AC3F_V1.1.0_build191121
The vendor-supplied default status for other versions is "unaffected." No CPE entries are published in the NVD record.
Patch Status
The NVD record lists no patched version, vendor fix, or mitigation guidance, and there is no CISA KEV required action or remediation deadline for this CVE. Consult the VulnCheck advisory and the researcher's disclosure repository below for the current state of vendor response.
Sources
- NVD, CVE-2026-47116: https://nvd.nist.gov/vuln/detail/CVE-2026-47116
- VulnCheck Advisory; LTSecurity LTK3500SF Hard-Coded Credentials via Telnet/SSH: https://www.vulncheck.com/advisories/ltsecurity-ltk3500sf-hard-coded-credentials-via-telnet-ssh
- Researcher Disclosure (Andrea Landriscina): https://github.com/AndreaLandriscina/Hardcoded-Credentials-in-LTSecurity-LTK3500SF