A fixed, hard-coded password in Lightstar's SmartIT Desktop Manager lets unauthenticated remote attackers reach and control managed user hosts, earning a CVSS 3.1 base score of 9.8 (Critical).
What Is It
CVE-2026-85148 is a Use of Hard-coded Credentials flaw (CWE-798) in SmartIT Desktop Manager, developed by Lightstar. According to the advisory from TWCERT/CC, the product ships with a fixed password that unauthenticated remote attackers can use to remotely access user hosts.
The CVE was published on 2026-09-04 and is currently in "Received" status at NVD, meaning it has not yet completed NVD analysis. Two severity ratings are supplied by the reporting CNA:
- CVSS 3.1: 9.8 (Critical):
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 4.0: 9.3 (Critical):
AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H
Why It Matters
Both vectors describe the worst-case exploitation profile: network-reachable, low attack complexity, no privileges, and no user interaction, with high impact to confidentiality, integrity, and availability. Hard-coded credentials typically cannot be rotated away through normal administrative controls, and if the password is identical across deployments, as the advisory's description of a fixed shipped password suggests, anyone who learns it would gain access to any exposed installation that has not been remediated by the vendor. The supplied data does not specify whether the credential is per-install or shared, so defenders should confirm this with the vendor.
Because SmartIT Desktop Manager is endpoint management software, the compromise target is the managed user hosts themselves, not just the management console.
There is no CISA KEV entry for this CVE in the supplied data, so active exploitation is not confirmed at this time.
What's Vulnerable
- Vendor: Lightstar
- Product: SmartIT Desktop Manager
- Affected versions: version 0 through 10 inclusive (
<= 10, custom version type) - All other versions default to unaffected per the CNA-supplied data.
No CPE entries have been assigned to this record yet.
Patch Status
The supplied NVD record contains no patch, fixed-version, mitigation, or vendor remediation information, and no KEV-mandated required action or due date. Defenders should consult the TWCERT/CC advisories below for vendor guidance and treat internet-exposed instances as high priority pending confirmation of a fixed release.
Sources
- NVD, CVE-2026-85148: https://nvd.nist.gov/vuln/detail/CVE-2026-85148
- TWCERT/CC Advisory (English): https://www.twcert.org.tw/en/cp-139-11177-13ca3-2.html
- TWCERT/CC Advisory (Chinese): https://www.twcert.org.tw/tw/cp-132-11176-a4cc2-1.html