PT-2026-20311 · Ispk-08+2 · Ispk-08+2

Vulncheck · Published 2026-02-17 · Updated 2026-02-22 · CVE-2026-23647

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Glory RBG-100 recycler systems using the ISPK-08 software component (affected versions not specified)

Description The Glory RBG-100 recycler systems, utilizing the ISPK-08 software component, are susceptible to unauthorized access due to hard-coded operating system credentials. These credentials enable remote authentication to the underlying Linux system. Multiple local user accounts, including those with administrative privileges, have fixed, embedded passwords. An attacker with network access to exposed services, such as SSH, can authenticate using these credentials and gain unauthorized access to the system. Successful exploitation allows remote access with elevated privileges, potentially leading to full system compromise.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

CVE-2026-23647

Affected Products

Glory Rbw-100

Ispk-08

Linux

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2026-23647 · Security Note
• https://vulncheck.com/advisories/glory-rbg-100-recycler-system-hard-coded-os-credentials · Note
• https://glory-global.com · Note
• https://twitter.com/offseq/status/2024046294591750414 · Twitter Post
• https://twitter.com/0dayPublishing/status/2023806166149587407 · Twitter Post
• https://twitter.com/CVEnew/status/2023809044226449502 · Twitter Post
• https://twitter.com/cracbot/status/2025526044707746290 · Twitter Post