PT-2026-6836 · Unknown · 3Dp-Manager

Denpiligrim · Publicado 2026-02-06 · Atualizado 2026-02-07 · CVE-2026-25803

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions 3DP-MANAGER versions 2.0.1 and prior

Description 3DP-MANAGER, an inbound generator for 3x-ui, automatically creates an administrative account with default credentials (admin/admin) upon initial setup. An attacker with network access to the application’s login interface can exploit this to gain full administrative control, including the ability to manage VPN tunnels and system settings.

Recommendations Update to version 2.0.2 to resolve this issue.

Exploit

Correção

Using Hardcoded Credentials

Enumeração de Fraquezas

CWE-798

Identificadores relacionados

CVE-2026-25803

GHSA-5X57-H7CW-9JMW

Produtos afetados

3Dp-Manager

Referências · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25803.json · Exploit
• https://github.com/denpiligrim/3dp-manager/security/advisories/GHSA-5x57-h7cw-9jmw · Aviso do Fabricante
• https://github.com/denpiligrim/3dp-manager/commit/f568de41de97dd1b70a963708a1ee18e52b9d248 · Correção
• https://twitter.com/0dayPublishing/status/2019911864868589813 · Publicação no Twitter
• https://twitter.com/CveFindCom/status/2019926950907609379 · Publicação no Twitter
• https://twitter.com/offseq/status/2020048195741503874 · Publicação no Twitter
• https://twitter.com/pulsepatchio/status/2020144985748959531 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-25803 · Nota de Segurança
• https://twitter.com/CVEnew/status/2019914475927937284 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2026-25803 · Aviso do Fabricante