Use of Hard-coded Credentials in SmartIT Desktop Manager by Lightstar
CVE-2026-85149

6.9MEDIUM

Key Information:

Vendor

Lightstar

Status
Smartit Desktop Manager
Vendor
CVE Published:
4 September 2026

What is CVE-2026-85149?

The SmartIT Desktop Manager by Lightstar contains a vulnerability that allows unauthenticated remote attackers to access sensitive SFTP service credentials embedded in the source code. This flaw could enable malicious actors to browse the file system of users’ hosts without authorization, raising significant security concerns. Organizations using this software should take immediate action to assess their environments and implement mitigations.

Affected Version(s)

SmartIT Desktop Manager 0 <= 10

References

https://www.twcert.org.tw/tw/cp-132-11176-a4cc2-1.html
third-party-advisory
https://www.twcert.org.tw/en/cp-139-11177-13ca3-2.html
third-party-advisory

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.