CVE-2026-25803: 3DP-MANAGER Hard-coded Default Administrator Credentials
CVE-2026-25803 affects 3DP-MANAGER versions 2.0.1 and earlier, which create an administrator account with the default credentials admin/admin on first initialization. The advisory describes full administrative control over VPN tunnels and system settings for attackers who can reach the login interface, and the record rates it Critical (CVSS 3.1 9.8). The record states the issue will be fixed in version 2.0.2, and no confirmed exploitation appears in the sources consulted.
Overview
CVE-2026-25803 is a Critical issue in 3DP-MANAGER, described as an inbound generator for 3x-ui. According to the record, versions 2.0.1 and earlier create an administrator account with the known default credentials admin/admin when the application is first initialized. The weakness is classified as CWE-798, Use of Hard-coded Credentials.
Impact
The description states that attackers with network access to the login interface can gain full administrative control, including managing VPN tunnels and system settings. The CVSS 3.1 vector in the record (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects network reachability, no privileges or user interaction required, and high impact to confidentiality, integrity and availability. Because the attacker only needs the default credentials, exposure of the login interface is the main factor that determines real-world risk.
Affected products and versions
- Product: Denpiligrim 3dp-manager
- Affected range in the record: 2.0.1 and earlier (listed as less than or equal to 2.0.1)
- Fixed version according to the description: 2.0.2
The record links a patch commit, but its content was not analyzed here, so the exact fixed state of that commit is not confirmed beyond the statement in the description.
Exploitation status
The CISA Known Exploited Vulnerabilities catalog does not list this CVE in the record, so no active exploitation is confirmed by that source. No confirmed exploitation is reported in the sources consulted. The EPSS probability in the record is 0.00594 (percentile 0.4697), which is a statistical estimate and not evidence of exploitation.
Remediation and mitigation
- Upgrade 3DP-MANAGER to version 2.0.2 or later, as stated in the description and referenced by the patch commit.
- Change the default administrator password and review whether the default account still exists in any installation, including instances that were initialized before patching.
- Do not expose the login interface to untrusted networks. Restrict access to administrative interfaces with network controls, VPN-only access or allowlists.
- Review accounts and VPN or system configuration changes for unexpected modifications if an instance was reachable with default credentials.
Detection guidance
- Check whether any installation still accepts the default admin/admin credentials and treat any positive result as a finding to remediate.
- Review authentication logs for successful administrative logins from unexpected sources or at unexpected times.
- Audit recent configuration changes to VPN tunnels, users and system settings, since the described impact includes these areas.
- Monitor for administrative logins originating from the internet if the interface is exposed.
Limitations of the available information
The record does not state the exact release that introduced the default account, the number of affected installations, or whether any public proof of concept exists. The description refers to version 2.0.2 as the fix using future tense, and the advisory and patch content were not reviewed in this analysis. The EPSS date in the record is not used for any conclusion.
Frequently asked questions
What is the core problem in CVE-2026-25803?
According to the record, 3DP-MANAGER versions 2.0.1 and earlier create an administrator account with the default credentials admin/admin on first initialization, which is a hard-coded credential weakness.
Which version fixes the issue?
The description states that the issue will be patched in version 2.0.2, and the record links a patch commit. The commit content was not reviewed in this analysis.
Is this CVE known to be exploited in the wild?
The CISA KEV catalog does not list it in the record, and no confirmed exploitation appears in the sources consulted.
What should administrators do now?
Upgrade to 2.0.2 or later, change the default administrator password, check whether the default account still exists, and restrict access to the login interface.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.