WebUI Template Database Exposes Default Passwords in Cleartext for Multiple Account Types

CVE-2026-22109

What is CVE-2026-22109?

The WebUI template database is affected by a security misconfiguration where factory default passwords for all five account types are retained in cleartext. This exposes identical default credentials across numerous devices, creating significant security risks if the default passwords are not changed post-installation. Attackers can exploit this vulnerability to gain unauthorized access to sensitive areas of the device, compromising the integrity of the system.

References