Executive Summary
CVE-2026-85148 is a critical use of hard-coded credentials vulnerability (CWE-798) in SmartIT Desktop Manager from Lightstar. The product relies on a fixed password that is identical across every deployment, allowing an unauthenticated remote attacker to use it to gain unauthorized access to any host managed by the SmartIT Agent.
CVSS Score: 9.8 (Critical) — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unlike a weak default password that an administrator can change, this credential is baked into the software itself and cannot be rotated by end users. TWCERT (Taiwan CERT) reserved and published the CVE on 2026-09-04.
Vulnerability Overview
| Attribute | Value |
|---|---|
| CVE ID | CVE-2026-85148 |
| CVSS Score | 9.8 (Critical) |
| CWE | CWE-798 — Use of Hard-Coded Credentials |
| Type | Unauthenticated remote host access via fixed password |
| Attack Vector | Network (no authentication required) |
| Privileges Required | None |
| User Interaction | None |
| Assigner | TWCERT |
Technical Details
SmartIT Desktop Manager exposes remote-access functionality on hosts running the SmartIT Agent, gated by a password that is fixed and shared across all installations rather than generated per-device or set by an administrator. Because the value is embedded in the shipped software, an attacker who reverse-engineers a single copy of the client obtains a credential that works against every deployment of the product — no prior authentication or user interaction is required, and only network reachability to the target agent is needed.
This is one of four related hard-coded credential issues disclosed together for SmartIT Desktop Manager:
| CVE | CVSS | Description |
|---|---|---|
| CVE-2026-85146 | 9.8 Critical | Hard-coded SSH service credentials embedded in source code |
| CVE-2026-85147 | 7.5 High | Hard-coded password recoverable from source, used to derive the AES communication key |
| CVE-2026-85148 (this advisory) | 9.8 Critical | Fixed password grants direct unauthenticated access to managed hosts |
| CVE-2026-85149 | 5.3 Medium | Hard-coded SFTP credentials expose the agent host's file system |
Impact of Successful Exploitation
| Impact | Description |
|---|---|
| Unauthorized Host Access | Attacker connects to any managed host using the fixed password |
| Persistent Backdoor | The credential cannot be changed by administrators, making the exposure permanent until patched |
| Confidentiality & Integrity Loss | Full read/write access to the compromised endpoint |
| Fleet-Wide Exposure | Identical credential works against every SmartIT deployment |
| Follow-On Attacks | Access can be chained with CVE-2026-85146/85149 for SSH and SFTP-level control |
Immediate Remediation
Lightstar had not published a patched version at the time of disclosure. Until a fix is available:
- Block remote access — restrict or disable the SmartIT remote-access feature at the network layer (firewall/ACL) so only trusted management hosts can reach it.
- Isolate managed endpoints — keep SmartIT-managed devices off the public internet and on a segmented management VLAN.
- Watch for unexpected remote sessions — alert on connections to the SmartIT Agent's remote-access port from unrecognized sources.
- Engage Lightstar support for a hotfix or documented mitigation.
- Evaluate temporary removal of SmartIT Agent from high-value or externally reachable systems.
Detection Indicators
| Indicator | Description |
|---|---|
| Remote-access connections to SmartIT Agent from unfamiliar IPs | Possible exploitation attempt |
| Successful login using the disclosed fixed password | Confirmed compromise |
| Configuration or file changes on SmartIT-managed hosts without a corresponding admin action | Possible unauthorized access |
References
- TWCERT/CC — SmartIT Desktop Manager Hard-Coded Credentials Advisory (TVN-20260901)
- NIST NVD — CVE-2026-85148
- OffSeq Threat Radar — CVE-2026-85148