Topic
A security weakness where secret keys, passwords, or API tokens are embedded directly in firmware or software, letting attackers extract and reuse them.
CISA says seven CVEs in Red Lion N-Tron 700 Series switches on firmware 3.11.0 or earlier can give an attacker administrative access. On any switch still waiting for firmware 3.11.1, a script that keeps requesting one URL can also hold it in a reboot loop.
Reality
CISA warns Armatura One embeds an Apache ActiveMQ still open to the 2023 flaw CVE-2023-46604, letting any network attacker run code at top privilege. Upgrading to 4.7.2, or 4.6.1 for the US build, closes it alongside four CVEs assigned in 2026.
Reality
DDoSecrets published filesystem images taken from a working Flock ALPR camera. The Android build inside them carries a hard-coded API key and a security patch level seven years older than the build itself.
Reality
CVE-2026-28326 scores 8.8 and affects every build of Access Rights Manager up to 2026.2. The fix is ARM 2026.2.1, and it lands weeks after SolarWinds patched a SAML bypass in Web Help Desk and 16 flaws in Serv-U.
Reality
Every version of five Digital Watchdog VMAX recorder lines ships with a web path that returns administrator passwords in the clear. CISA says the same devices can be used to pivot onto the network behind them.
Reality
The advisory on TPDIN-Monitor-WEB3 2.2.9 and earlier lists hard-coded credentials, cross-site request forgery and missing authorization on units running in energy and critical manufacturing. Firmware v2.4.2 is the whole fix.
Reality