CVE-2026-22886
Gravedad CVSS v3.1:
CRÍTICA
Tipo:
No Disponible / Otro tipo
Fecha de publicación:
03/03/2026
Última modificación:
03/03/2026
Descripción
*** Pendiente de traducción *** OpenMQ exposes a TCP-based management service (imqbrokerd) that by default requires<br />
authentication. However, the product ships with a default administrative account (admin/<br />
admin) and does not enforce a mandatory password change on first use. After the first<br />
successful login, the server continues to accept the default password indefinitely without<br />
warning or enforcement.<br />
<br />
<br />
In real-world deployments, this service is often left enabled without changing the default<br />
credentials. As a result, a remote attacker with access to the service port could authenticate<br />
as an administrator and gain full control of the protocol’s administrative features.
Impacto
Puntuación base 3.x
9.80
Gravedad 3.x
CRÍTICA