Hardcoded-Credentials — CraftedSignal Threat Feed

osuuu LightPicture Hardcoded Credentials Vulnerability (CVE-2026-6574)

hello@craftedsignal.io — Sun, 19 Apr 2026 14:16:11 +0000

osuuu LightPicture, up to version 1.2.2, is vulnerable to a hardcoded credentials exposure vulnerability (CVE-2026-6574). This flaw resides within the API Upload Endpoint and is triggered when processing the /public/install/lp.sql file. An attacker can manipulate the key argument to exploit this vulnerability. The vendor has been notified about the vulnerability but has not responded. Public exploits are available, increasing the risk of exploitation. This vulnerability allows an attacker to potentially gain unauthorized access and control over the application.

Attack Chain

Attacker identifies an instance of osuuu LightPicture running version 1.2.2 or earlier.
The attacker crafts a malicious HTTP request targeting the API Upload Endpoint.
The request includes a modified key argument within the /public/install/lp.sql file path.
The application processes the crafted request without proper sanitization.
Due to the manipulated key argument, the application exposes hardcoded credentials.
The attacker retrieves the exposed hardcoded credentials from the server’s response.
The attacker leverages the acquired credentials to authenticate and gain unauthorized access to the application.
With unauthorized access, the attacker can perform malicious activities such as data theft, modification, or deletion.

Impact

Successful exploitation of CVE-2026-6574 can lead to complete compromise of the osuuu LightPicture application and potentially the underlying server. The vulnerability exposes hardcoded credentials, enabling attackers to bypass authentication and gain administrative privileges. The impact includes unauthorized access to sensitive data, modification of application settings, and potential disruption of service. The vulnerability affects all installations of osuuu LightPicture up to version 1.2.2.

Recommendation

Deploy the Sigma rule Detect Suspicious LP.SQL Access to identify attempts to access the vulnerable file (log source: webserver).
Apply input validation and sanitization to the key argument within the API Upload Endpoint to prevent manipulation (reference CVE-2026-6574).
Monitor web server logs for suspicious requests targeting the /public/install/lp.sql file with unusual parameters (log source: webserver).
If upgrading is not possible, implement a web application firewall (WAF) rule to block requests containing malicious patterns in the key argument (log source: firewall).

Hardcoded Storage Credentials in Mobile App and Device Firmware (CVE-2025-10681)

hello@craftedsignal.io — Fri, 03 Apr 2026 21:17:08 +0000

CVE-2025-10681 exposes a critical vulnerability stemming from the presence of hardcoded storage credentials within a mobile application and its corresponding device firmware. These credentials, unfortunately, lack sufficient restrictions on end-user permissions and are not configured to expire after a reasonable period. The affected systems are not explicitly mentioned, but the advisory was published by ICS-CERT implying the vulnerability exists within an Industrial Control System or similar operational technology environment. This flaw allows a malicious actor to bypass standard authentication mechanisms and directly access sensitive data stored within production storage containers, potentially causing significant data breaches and operational disruption. Defenders should prioritize identifying devices using default credentials, especially in OT environments where a compromise could have physical consequences.

Attack Chain

Attacker gains access to the mobile application or device firmware through reverse engineering or by acquiring a compromised device.
Attacker extracts the hardcoded storage credentials from the mobile app or firmware.
Attacker leverages the extracted credentials to authenticate directly with the production storage container.
Due to the lack of adequate permission restrictions, the attacker gains read/write access to sensitive data within the storage container.
Attacker accesses sensitive data like configurations, process data, or customer data.
Attacker modifies sensitive data like configurations causing a denial of service, or operational disruption.
Attacker gains complete control over the storage container and potentially linked resources.
The attacker exfiltrates sensitive data or uses it to further compromise the ICS/OT environment.

Impact

Successful exploitation of CVE-2025-10681 could lead to unauthorized access to critical production data, system configurations, and potentially other sensitive information. Depending on the scope of the storage container’s access, attackers could disrupt industrial processes, steal intellectual property, or hold data for ransom. Since this vulnerability relates to ICS/OT environments, compromise of production data could lead to equipment damage, environmental hazards, or safety issues.

Recommendation

Implement the detection rule Detect Hardcoded Credentials in Mobile App/Firmware Unpacking to detect attempts to unpack or analyze application binaries or firmware images that may contain hardcoded credentials (logsource: file_event, process_creation).
Examine network traffic for authentication attempts to storage resources using unusual user agents or originating from unusual IP addresses that might indicate credential compromise, using the detection rule Detect Unusual Authentication to Storage Resources. (logsource: network_connection)
Review and update mobile application and device firmware development practices to eliminate the use of hardcoded credentials, referencing CWE-798 (Use of Hard-coded Credentials).
Monitor file access and modifications to production storage containers, looking for unusual activity that might indicate unauthorized access following exploitation of CVE-2025-10681 (logsource: file_event).
Use vulnerability scanning tools to identify devices and applications vulnerable to CVE-2025-10681.

GoHarbor Harbor v2.15.0 and Below Vulnerable to Hardcoded Credentials

hello@craftedsignal.io — Wed, 25 Mar 2026 12:00:00 +0000

GoHarbor Harbor, a popular open-source cloud native registry, is susceptible to a critical vulnerability (CVE-2026-4404) in versions 2.15.0 and below. This flaw stems from the use of hardcoded credentials, specifically a default password, which, if unchanged, allows unauthorized access to the web UI. An attacker exploiting this vulnerability can bypass authentication and potentially gain full control over the Harbor instance. This poses a significant risk to organizations using affected Harbor versions, as it can lead to data breaches, container image tampering, and other malicious activities. The vulnerability was reported in March 2026, and defenders should prioritize upgrading or mitigating affected instances.

Attack Chain

Attacker identifies a GoHarbor Harbor instance running version 2.15.0 or below.
Attacker accesses the web UI login page of the Harbor instance.
Attacker enters the default username (“admin”) and password (“Harbor12345”), as documented in the official GoHarbor documentation.
The Harbor instance authenticates the attacker due to the use of default credentials.
Attacker gains access to the Harbor web UI with administrator privileges.
Attacker can now manage container images, repositories, and users within the Harbor instance.
Attacker may pull sensitive images, inject malicious code into existing images, or create new malicious images.
The attacker uses the now compromised Harbor instance to distribute malicious container images throughout the organization’s infrastructure, leading to widespread compromise.

Impact

Successful exploitation of this vulnerability allows an attacker to gain complete control over a GoHarbor Harbor instance. This can lead to the compromise of container images, potentially injecting malware into the software supply chain. The impact could range from data exfiltration and service disruption to full system compromise, depending on the privileges associated with the Harbor instance. Given the widespread use of GoHarbor in cloud-native environments, this vulnerability presents a significant risk to numerous organizations.

Recommendation

Immediately upgrade GoHarbor Harbor instances to a version greater than 2.15.0 to remediate CVE-2026-4404.
If upgrading is not immediately feasible, change the default “admin” password (“Harbor12345”) to a strong, unique password as outlined in the GoHarbor documentation.
Deploy the provided Sigma rule to detect login attempts using the default credentials against the Harbor web UI based on webserver logs.
Regularly review and update credentials for all services and applications to prevent the exploitation of default or hardcoded passwords.

AstrBotDevs AstrBot Vulnerability Leads to Hardcoded Credentials (CVE-2026-7579)

hello@craftedsignal.io — Wed, 03 Jan 2024 12:00:00 +0000

A critical security vulnerability, CVE-2026-7579, has been identified in AstrBotDevs AstrBot, affecting versions up to 4.16.0. The vulnerability lies within the Dashboard component, specifically in the astrbot/dashboard/routes/auth.py file. An unspecified processing flaw allows attackers to retrieve or leverage hardcoded credentials. The vulnerability can be exploited remotely and has been publicly disclosed, increasing the risk of exploitation. The vendor was notified, but did not respond to the disclosure. Successful exploitation could lead to unauthorized access to sensitive information or control over the AstrBot application.

Attack Chain

Attacker identifies a vulnerable AstrBot instance running a version up to 4.16.0.
Attacker sends a crafted request to the astrbot/dashboard/routes/auth.py endpoint.
The vulnerable code in auth.py processes the request improperly, exposing hardcoded credentials.
Attacker extracts the hardcoded credentials from the response.
Attacker uses the hardcoded credentials to authenticate to the AstrBot dashboard.
Attacker gains unauthorized access to administrative functions within the AstrBot application.
Attacker uses the compromised access to modify bot configurations or access user data.
Attacker leverages compromised bot to conduct malicious activity such as spam or data theft.

Impact

Successful exploitation of CVE-2026-7579 allows a remote attacker to obtain hardcoded credentials, leading to complete control over the AstrBot application. This can result in unauthorized access to sensitive data, modification of bot configurations, and potential misuse of the bot for malicious purposes. The lack of vendor response exacerbates the risk, leaving users vulnerable to potential attacks.

Recommendation

Upgrade AstrBot to a patched version beyond 4.16.0 if a patch becomes available from AstrBotDevs to remediate CVE-2026-7579.
Monitor web server logs for suspicious requests targeting the astrbot/dashboard/routes/auth.py endpoint as described in the Attack Chain.
Deploy the Sigma rule detecting access to the vulnerable auth.py route to identify potential exploitation attempts.
Implement strong authentication and authorization mechanisms to protect the AstrBot dashboard, mitigating the impact of hardcoded credentials.