CVE-2026-18191
The VIN‑DS783E‑E6 device from Vacron contains a hidden function that can be triggered by anyone on the network. An attacker can use this to retrieve the administrator password without needing any credentials. This gives the attacker full control over the device.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
VIN‑DS783E‑E6 devices manufactured by Vacron.
Real-world impact
If exploited, an attacker could obtain the administrator credentials and then take over the device, potentially compromising any systems it controls or uses for data collection.
Why this severity
The CVSS score of 9.3 reflects that the vulnerability allows remote unauthenticated attackers to gain full confidentiality, integrity, and availability impact. The lack of authentication or user interaction requirements makes it highly dangerous.
What to do about it
- ›Restrict network access to the VIN‑DS783E‑E6 device so only trusted hosts can reach it.
- ›Change the default administrator password to a strong, unique one.
- ›If the device allows disabling hidden functions, do so.
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources