Critical Hard-Coded Credential Flaw in DMS+

Security researchers have identified a critical vulnerability, tracked as CVE-2026-18452, affecting the Rich Source DMS+ (Non-Mobile) platform. This flaw stems from the use of hard-coded credentials, granting unauthenticated remote attackers the ability to compromise all installed DMS+ devices.

What's at Risk

The vulnerability carries a maximum CVSS 3.1 score of 10.0, indicating a critical risk level. Because the flaw allows for unauthenticated remote access, any deployment of DMS+ that is reachable via the internet is at significant risk of total takeover. Organizations utilizing this software for device management should treat this as a high-priority exposure.

This risk is amplified by the nature of the vulnerability, which bypasses authentication mechanisms entirely. Any system running the affected version of the software is potentially exposed, as the fixed API key provides a universal entry point for unauthorized actors.

How the Flaw Works

Hard-coded credentials represent a fundamental security weakness where developers embed sensitive authentication data, such as API keys or passwords, directly into the application source code or configuration files. This practice is dangerous because it removes the ability for administrators to rotate or secure these credentials. Once the key is discovered, it remains valid across all installations that use the same hard-coded value.

In a typical exploit scenario, an attacker identifies the presence of the hard-coded key through reverse engineering or by analyzing publicly accessible configuration files. Once obtained, the attacker can submit these credentials to the application's API endpoints. Because the system is designed to accept this specific, immutable key, the attacker is granted the same privileges as an administrator, enabling them to execute commands, modify system settings, or extract sensitive data without ever needing a valid user account.

How to Protect Your Systems

• Review all deployments of DMS+ and immediately restrict network access to these systems to authorized IP ranges only.
• Remove internet-facing exposure for all DMS+ instances until a vendor-supplied patch is applied.
• Monitor system logs for unusual API calls or unauthorized connection attempts originating from unknown sources.
• Implement network segmentation to ensure that even if a device is compromised, the attacker cannot pivot to more sensitive areas of the internal network.
• Apply vendor-provided updates immediately upon release to address the hard-coded credential flaw.

The critical severity of CVE-2026-18452 underscores the danger posed by hard-coded credentials in management software. With the potential for full system control, the window for remediation is narrow. Organizations must prioritize hardening their network perimeters and applying vendor updates to mitigate this threat effectively.