CVE-2026-90457: Weak Password Hash Information Disclosure

CVE-2026-90457 Overview

CVE-2026-90457 describes a credential storage weakness in which an administrative password is hashed with a fast, comparatively weak algorithm and stored in a file readable by any local user. A second authentication path for the same product hashes the identical password using a stronger algorithm, creating an inconsistency an attacker can exploit. Any local user, or anyone with access to a configuration backup, can copy the hash and perform offline cracking. Successful recovery yields the administrative credential accepted across every authentication path. The issue is tracked under CWE-916: Use of Password Hash With Insufficient Computational Effort and is documented in CISA ICS Advisory ICSA-26-254-01.

Critical Impact
A local user or holder of a configuration backup can recover the administrative password offline and gain full administrative access.

Affected Products

Product details are published in CISA ICS Advisory ICSA-26-254-01
Operational technology (OT) / industrial control system component per CISA advisory scope
Specific vendor and version identifiers are not enumerated in the NVD entry

Discovery Timeline

2026-09-11 - CVE-2026-90457 published to the National Vulnerability Database (NVD)
2026-09-18 - Last updated in NVD database

Technical Details for CVE-2026-90457

Vulnerability Analysis

The flaw is a credential storage weakness (CWE-916). The affected component maintains two authentication paths that share a single administrative password. One path stores the password using a strong, computationally expensive hashing algorithm. The other path stores the same password using a fast, general-purpose hashing algorithm not designed for password protection. Fast hashes allow attackers to test billions of candidate passwords per second on commodity GPUs.

Compounding the algorithm choice, the file containing the weaker hash is written with permissions that allow any local user to read it. Configuration backups likewise carry the hash outside the device to any operator or integrator with backup access. The stronger hash on the other path provides no protection once the weaker hash is recovered, because both paths accept the same underlying plaintext.

Root Cause

The root cause is inconsistent cryptographic policy across two authentication paths that share credentials, combined with permissive file permissions on the weaker credential store. There is no salt strength or work-factor control that would make offline recovery infeasible for the weak-hash path.

Attack Vector

Exploitation requires local read access to the credential file or possession of a configuration backup. The attacker copies the hash, transfers it to attacker-controlled hardware, and runs offline dictionary or brute-force attacks. Once the plaintext is recovered, the attacker authenticates as the administrator through any interface the device exposes. No network access and no user interaction are needed at the exploitation stage.

No public proof-of-concept, exploit code, or in-the-wild exploitation has been reported. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2026-90457

Indicators of Compromise

Unexpected read access to the credential storage file by non-administrative local accounts
Copies of configuration backups appearing on user workstations, removable media, or shared file locations
Administrative logins from workstations, source addresses, or time windows inconsistent with the operator baseline
New or modified administrative accounts, role assignments, or configuration changes without a change ticket

Detection Strategies

Audit file-access events on the credential store and alert on any reader that is not the service account owning the file
Correlate configuration backup export events with subsequent administrative logins from new sources
Baseline administrative session sources and flag deviations for review
Track repeated failed authentications followed by a successful login, which can indicate credential recovery followed by reuse

Monitoring Recommendations

Forward device audit logs, file-access telemetry, and backup export events to a central analytics platform for correlation
Monitor egress of configuration files to endpoints and cloud storage services
Review privileged account activity on a recurring cadence and validate against change management records
Track handling of configuration backups end-to-end, including who exported, transported, and stored each copy

How to Mitigate CVE-2026-90457

Immediate Actions Required

Apply the vendor update referenced in CISA ICS Advisory ICSA-26-254-01 once available for the deployed version
Rotate the administrative password on every affected device, assuming the current hash may already be recoverable
Inventory and secure all existing configuration backups, then destroy copies no longer required
Restrict local shell and file-system access on affected devices to a minimum set of accounts

Patch Information

Refer to CISA ICS Advisory ICSA-26-254-01 for the authoritative list of affected products, fixed versions, and vendor remediation guidance. The advisory is the single source published with this CVE at the time of writing.

Workarounds

Tighten file permissions on the credential store so that only the owning service account can read it, where the platform permits such changes
Encrypt configuration backups at rest and in transit, and store them in access-controlled locations
Segment management interfaces on a dedicated network and restrict local access to authenticated operators
Use unique administrative passwords per device to limit the blast radius of any single hash recovery

bash

# Configuration example: restrict read access on a credential store file (Linux)
# Replace /path/to/credential_store with the actual file path from vendor documentation
chown root:root /path/to/credential_store
chmod 600 /path/to/credential_store
auditctl -w /path/to/credential_store -p rwa -k cve_2026_90457_credstore