CVE-2026-18452: DMS+ Hard-coded Credentials Vulnerability

CVE-2026-18452 Overview

CVE-2026-18452 is a hard-coded credentials vulnerability [CWE-798] in DMS+ (Non-Mobile), developed by Rich Source. The product embeds a fixed API key that unauthenticated remote attackers can extract and reuse. Attackers who obtain the key can gain control over all installed DMS+ devices across affected deployments.

The flaw requires no authentication, no user interaction, and is exploitable over the network. Because the same key is shared across installations, compromise of a single instance exposes the entire product ecosystem. TWCERT has published advisories describing the issue.

Critical Impact
Unauthenticated remote attackers can leverage a fixed API key to gain full control over all installed DMS+ devices, impacting confidentiality, integrity, and availability.

Affected Products

Rich Source DMS+ (Non-Mobile)
All DMS+ Non-Mobile installations that ship with the fixed API key
Downstream devices managed through vulnerable DMS+ deployments

Discovery Timeline

2026-07-31 - CVE-2026-18452 published to NVD
2026-07-31 - Last updated in NVD database

Technical Details for CVE-2026-18452

Vulnerability Analysis

The vulnerability stems from the Use of Hard-coded Credentials weakness class [CWE-798]. DMS+ (Non-Mobile) ships with a static API key that authenticates privileged operations against the device management interface. Because the key is embedded in the product distribution, it is identical across all installations and cannot be rotated by end users.

An attacker who recovers the key from firmware, application binaries, network captures, or public disclosure can authenticate to any DMS+ device reachable over the network. The impact spans confidentiality, integrity, and availability of both the vulnerable component and any downstream systems it manages.

Root Cause

The root cause is a design decision to authenticate API calls with a hard-coded shared secret rather than per-installation credentials. This pattern removes the trust boundary between the vendor build artifact and each customer deployment. Reverse engineering, binary inspection, or accidental disclosure of the key defeats authentication for every deployed instance.

Attack Vector

The attack vector is network-based and requires no privileges or user interaction. An attacker locates internet-exposed or LAN-reachable DMS+ management endpoints, then submits API requests using the recovered fixed key. Successful requests permit device configuration changes, credential retrieval, command execution paths exposed through the API, and control over connected devices. Because the key is static, mass exploitation via automated scanning is straightforward.

No verified exploit code is available in public repositories. See the TWCERT Incident Report and TWCERT Security Advisory for vendor-coordinated technical details.

Detection Methods for CVE-2026-18452

Indicators of Compromise

Unexpected API requests to DMS+ management endpoints from unknown source IP addresses
Configuration changes on DMS+ devices with no corresponding administrator activity in change-management records
New or modified accounts, integrations, or downstream device bindings on DMS+ instances
Outbound connections initiated by DMS+ devices to unfamiliar remote hosts

Detection Strategies

Inspect application and reverse-proxy logs for API calls presenting the vendor-issued static key from non-approved source networks
Baseline normal administrative source addresses and alert on API authentication from any other origin
Correlate DMS+ configuration change events with authenticated administrator sessions to surface unattributed changes

Monitoring Recommendations

Forward DMS+ access, audit, and configuration logs to a central SIEM for retention and correlation
Enable network flow monitoring for management VLANs hosting DMS+ devices
Alert on scanning behavior against DMS+ API paths from external ranges

How to Mitigate CVE-2026-18452

Immediate Actions Required

Remove DMS+ (Non-Mobile) management interfaces from the public internet and restrict access to trusted management networks
Apply vendor-supplied firmware or software updates from Rich Source as soon as they are released
Rotate any secrets, downstream device credentials, or integration tokens that may have been exposed through vulnerable DMS+ instances
Review recent audit logs for unauthorized API activity dating back to product installation

Patch Information

At the time of publication, refer to the TWCERT Security Advisory and the TWCERT Incident Report for the current remediation guidance from Rich Source. Affected operators should contact the vendor for a fixed build that replaces the hard-coded API key with per-installation credentials.

Workarounds

Place DMS+ management endpoints behind a VPN or zero-trust access gateway that enforces its own authentication
Apply firewall rules that allow API traffic only from a defined administrative source list
Disable or block any DMS+ features that expose the API externally until a fixed version is deployed

bash

# Example: restrict DMS+ management API to an administrative subnet
iptables -A INPUT -p tcp --dport 443 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP