CVE-2026-18452Hard-coded API key in Rich Source DMS+
DMS+ (Non-Mobile) developed by Rich Source has a Use of Hard-coded Credentials vulnerability. Unauthenticated remote attackers can exploit a fixed API key to gain control over all installed DMS+ devices.
View on NVDAnalysis
DMS+ (Non-Mobile) de Rich Source contiene una vulnerabilidad de credenciales embebidas que permite a atacantes remotos no autenticados tomar control total de los dispositivos afectados mediante una llave de API fija. Debido a que la clave es estática y universal para todas las instalaciones, cualquier sistema expuesto puede ser comprometido de forma administrativa sin conocimiento previo.
Relevant roles
Severity
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:HCWE-798EPSS
No EPSS score yet (CVE may be too fresh).
Technical description
DMS+ (Non-Mobile) developed by Rich Source has a Use of Hard-coded Credentials vulnerability. Unauthenticated remote attackers can exploit a fixed API key to gain control over all installed DMS+ devices.