Executive Summary
CVE-2026-85146 is a critical use of hard-coded credentials vulnerability (CWE-798) in SmartIT Desktop Manager, a remote-endpoint management tool developed by Lightstar. The SSH service account credentials and passwords used by the SmartIT Agent are embedded directly in the application's source code, allowing an unauthenticated remote attacker to extract them and gain SSH access to any managed endpoint.
CVSS Score: 9.8 (Critical) — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Because the credentials are static and shipped inside the software itself, patching a single deployment does not help — every installation built from the same vulnerable codebase shares the identical SSH account. The flaw was reserved and published on 2026-09-04 with TWCERT (Taiwan CERT) as the CNA.
Vulnerability Overview
| Attribute | Value |
|---|---|
| CVE ID | CVE-2026-85146 |
| CVSS Score | 9.8 (Critical) |
| CWE | CWE-798 — Use of Hard-Coded Credentials |
| Type | Unauthenticated SSH credential exposure |
| Attack Vector | Network (no authentication required) |
| Privileges Required | None |
| User Interaction | None |
| Assigner | TWCERT |
Technical Details
SmartIT Desktop Manager ships with a bundled SmartIT Agent that exposes an SSH service on managed endpoints for remote administration. The SSH service account username and password are hard-coded into the application's source code rather than generated or configured per-deployment. Any attacker who obtains a copy of the client (or decompiles the binary) recovers a working SSH credential set that is valid across every installation of the product.
This disclosure is part of a batch of four related hard-coded credential issues in the same product line, published together by TWCERT:
| CVE | CVSS | Description |
|---|---|---|
| CVE-2026-85146 (this advisory) | 9.8 Critical | Hard-coded SSH service credentials in SmartIT Agent |
| CVE-2026-85147 | 7.5 High | Hard-coded password recoverable from source, used to derive the AES communication key |
| CVE-2026-85148 | 9.8 Critical | Fixed password grants direct unauthenticated access to managed hosts |
| CVE-2026-85149 | 5.3 Medium | Hard-coded SFTP credentials expose the agent host's file system |
Impact of Successful Exploitation
| Impact | Description |
|---|---|
| Unauthorized SSH Access | Attacker logs into any managed endpoint using the extracted credentials |
| Full Endpoint Compromise | SSH access typically allows command execution, file access, and persistence |
| Fleet-Wide Exposure | The same credentials are valid across every deployment built from the vulnerable codebase |
| Confidentiality & Integrity Loss | Attacker can read, modify, or destroy data on the compromised host |
| Lateral Movement | Compromised endpoints can be used as a pivot point into the broader network |
Immediate Remediation
As of publication, no patched version number has been disclosed by Lightstar. Until an official fix is available:
- Restrict network exposure — firewall the SSH port used by the SmartIT Agent to management-network sources only; never expose it to the internet.
- Segment managed endpoints — place hosts running SmartIT Agent on an isolated VLAN with strict egress/ingress controls.
- Monitor for anomalous SSH logins — alert on connections to the agent's SSH service from unexpected source IPs.
- Contact Lightstar for a patched build or guidance on rotating the embedded credentials.
- Consider decommissioning SmartIT Desktop Manager for internet-facing or otherwise high-risk endpoints until a fix ships.
Detection Indicators
| Indicator | Description |
|---|---|
| SSH connections to the SmartIT Agent port from unfamiliar IPs | Possible exploitation attempt |
| Successful SSH auth using the disclosed default account | Confirmed compromise |
| Outbound connections initiated from SmartIT-managed hosts | Possible post-exploitation activity |
References
- TWCERT/CC — SmartIT Desktop Manager Hard-Coded Credentials Advisory (TVN-20260901)
- NIST NVD — CVE-2026-85146
- OffSeq Threat Radar — CVE-2026-85146