PT-2026-6836 · Unknown · 3Dp-Manager

Denpiligrim · Published 2026-02-06 · Updated 2026-02-07 · CVE-2026-25803

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions 3DP-MANAGER versions 2.0.1 and prior

Description 3DP-MANAGER, an inbound generator for 3x-ui, automatically creates an administrative account with default credentials (admin/admin) upon initial setup. An attacker with network access to the application’s login interface can exploit this to gain full administrative control, including the ability to manage VPN tunnels and system settings.

Recommendations Update to version 2.0.2 to resolve this issue.

Exploit

Fix

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

CVE-2026-25803

GHSA-5X57-H7CW-9JMW

Affected Products

3Dp-Manager

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25803.json · Exploit
• https://github.com/denpiligrim/3dp-manager/security/advisories/GHSA-5x57-h7cw-9jmw · Vendor Advisory
• https://github.com/denpiligrim/3dp-manager/commit/f568de41de97dd1b70a963708a1ee18e52b9d248 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-25803 · Security Note
• https://osv.dev/vulnerability/CVE-2026-25803 · Vendor Advisory
• https://twitter.com/0dayPublishing/status/2019911864868589813 · Twitter Post
• https://twitter.com/CveFindCom/status/2019926950907609379 · Twitter Post
• https://twitter.com/offseq/status/2020048195741503874 · Twitter Post
• https://twitter.com/pulsepatchio/status/2020144985748959531 · Twitter Post
• https://twitter.com/CVEnew/status/2019914475927937284 · Twitter Post