Cyber & AI intelligence
Wasteland.
Briefs indexed2410
Issues26
Published Mondays07:30 CT
⚡ Active KEV CVE-2026-85146 2026-09-04

CVE-2026-85146: Hard-Coded SSH Credentials in Lightstar SmartIT Desktop Manager

"Lightstar's SmartIT Desktop Manager ships SSH service account credentials directly in its application source code; a design that, per the vendor advisory, would let unauthenticated remote attackers extract those…"

Lightstar's SmartIT Desktop Manager ships SSH service account credentials directly in its application source code; a design that, per the vendor advisory, would let unauthenticated remote attackers extract those credentials and potentially use them against SmartIT Agent hosts.

What Is It

CVE-2026-85146 is a Use of Hard-coded Credentials flaw (CWE-798) in SmartIT Desktop Manager, developed by Lightstar. According to the advisory from TWCERT, the SSH service account credentials and passwords used by the SmartIT Agent are embedded in the application source code. Unauthenticated remote attackers can obtain those credentials directly from the application, with no prior access or user interaction required.

The vulnerability was published on 2026-09-04 with a CVSS v3.1 base score of 9.8 (Critical): vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. TWCERT also assigned a CVSS v4.0 score of 9.3 (Critical).

Why It Matters

The scoring tells the story: network attack vector, low attack complexity, no privileges, no user interaction, and high impact across confidentiality, integrity, and availability. Hard-coded credentials are typically not rotatable by the operator, and in the common case the embedded secret is likely to be identical across deployments; if that holds here, a single disclosure would effectively be a disclosure against every installation. Neither the NVD record nor the TWCERT advisories state whether the credentials vary per install, so that remains unconfirmed.

Because the exposed credentials are for an SSH service account tied to the SmartIT Agent, successful extraction would plausibly translate into direct interactive access to managed endpoints, depending on how the account is scoped and whether the SSH service is reachable from the attacker's position. Desktop management software sits in a privileged position across an estate by design, which makes it an attractive pivot point.

CISA KEV: no KEV entry was supplied for this CVE, so no KEV-mandated remediation deadline applies. That absence should be read as a lack of confirmed public reporting rather than as evidence that the flaw is not being exploited; exploitation may be occurring without having been catalogued.

What's Vulnerable

No CPE entries were listed in the NVD record at time of publication.

Patch Status

The supplied NVD record carries a status of Received and does not include patch, fixed-version, or vendor remediation details. Refer to the TWCERT advisories below for vendor guidance and any available update. Organizations running SmartIT Desktop Manager should treat the SmartIT Agent SSH account as compromised and restrict network reachability of the SSH service pending vendor direction.

Sources