DMS+ (Non-Mobile) is vulnerable to a critical hardcoded credential flaw that permits unauthenticated attackers to hijack the device.

The product utilizes hardcoded credentials (CWE-798) within its API. This allows an unauthenticated attacker to send malicious requests and gain unauthorized access to the device management functions.

With a CVSS score of 10.0, this represents the highest level of risk. An attacker can gain full control over all deployed DMS+ devices, potentially leading to widespread operational disruption, data theft, and the use of the devices as a platform for further network attacks.

Immediate Action: Update all instances of DMS+ (Non-Mobile) to version 5.64 or later.

Proactive Monitoring: Review API logs for unauthorized access attempts or unusual command activity that deviates from standard operational baselines.

Compensating Controls: Restrict access to the API endpoints using network level access control lists (ACLs) to ensure that only authorized internal systems can communicate with the devices.

Public Exploit Available: Unknown

This is an extremely critical vulnerability requiring immediate attention. Administrators must update all vulnerable DMS+ devices to version 5.64 immediately to prevent potential remote exploitation and complete device takeover.