CVE-2026-22906: Hard-coded key AES-ECB credential storage exposing usernames and passwords (CWE-321)

Overview

CVE-2026-22906 describes user credentials stored with AES-ECB encryption using a hardcoded key, mapped to CWE-321 (Use of Hard-coded Cryptographic Key). The record was published on 2026-02-09 by the CNA info@cert.vde.com, and its source status is recorded as Deferred. The primary vendor reference is the VDE advisory VDE-2026-004.

Impact

• According to the record, an unauthenticated remote attacker who obtains the configuration file can decrypt and recover plaintext usernames and passwords.
• The record states that the exposure is especially relevant when combined with an authentication bypass. That bypass is referenced but not described in the available data.
• The CNA assigns a CVSS 3.1 base score of 9.8 (severity critical) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Affected products and versions

• The record contains no affected product, vendor or version list. The affected scope cannot be determined from the consulted data.
• No fixed version is listed. This does not mean no fix exists; it means the data is missing. Check the vendor advisory for product-specific details.

Exploitation status

• The CISA KEV catalog does not list this CVE, so no confirmed active exploitation is recorded in the sources consulted.
• The EPSS record shows a probability of 0.00358 and a percentile of 0.27722 with date 2026-10-13. These values estimate exploitation likelihood but do not confirm exploitation.

Remediation and mitigation

• Review the vendor advisory VDE-2026-004 for the affected products and the official remediation.
• Assume that credentials stored in affected configuration files may be compromised. Rotate usernames and passwords after applying the vendor update or workaround.
• Restrict access to configuration files and backups to the minimum required accounts, and keep them off publicly reachable systems.
• Limit network exposure of affected management interfaces until the vendor guidance is applied.
• Plan the migration away from hardcoded keys and from ECB mode to authenticated, key-managed storage, consistent with the vendor's guidance.

Detection guidance

• Inventory systems that use the affected product and monitor who accesses or downloads configuration files.
• Review logs for unauthenticated requests that reach configuration resources or authentication endpoints.
• Alert on unexpected changes to configuration files and on authentication anomalies.

Limitations of the available information

• No affected product names, versions or fixed versions are present in the record.
• The CWE name field is empty in the record, and the CWE class is taken from the identifier only.
• The authentication bypass mentioned in the description is not identified or described.
• No SSVC data is available.
• The EPSS date in the record is recorded as provided and was not independently verified.

Frequently asked questions

What is the core weakness in CVE-2026-22906?

User credentials are encrypted with AES-ECB using a hardcoded key, so anyone who obtains the configuration file may be able to recover the plaintext usernames and passwords.

Is this CVE confirmed to be actively exploited?

No. The CISA KEV catalog does not list it, so no confirmed active exploitation appears in the sources consulted.

Which versions are affected and what is the fix?

The record does not list affected or fixed versions. Check the vendor advisory VDE-2026-004 for product-specific details and the official remediation.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.