CVE Intelligence
Analysis AI-assisted

CVE-2026-27507: Binardat 10G08-0800GSM Network Switch Hard-coded Credentials

The Binardat 10G08-0800GSM network switch firmware, version V300SP10260209 and earlier, contains hard-coded administrative credentials that users cannot change. Anyone who learns these credentials can gain full administrative control of the device. The record reports a CVSS score of 9.8, and no confirmed exploitation appears in the sources consulted.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

CVE-2026-27507 describes hard-coded administrative credentials in the Binardat 10G08-0800GSM network switch firmware, version V300SP10260209 and earlier. The CNA is VulnCheck, the record was published on 2026-02-24, and the weakness is classified as CWE-798 (Use of Hard-coded Credentials).

Impact

  • The credentials are built into the product and users cannot change them.
  • Knowledge of the credentials gives full administrative access to the device.
  • The vector in the record is network-reachable (AV:N), requires no privileges (PR:N) and no user interaction (UI:N), with high confidentiality, integrity and availability impact.
  • The record reports a CVSS score of 9.8 from VulnCheck and a 9.3 score under a newer CVSS revision.

Affected products and versions

  • Binardat 10g08-0800gsm Firmware: V300SP10260209 and prior.
  • Binardat 10G08-0800GSM Network Switch: V300SP10260209 and prior.
  • No fixed version is listed in the record.

Exploitation status

The vulnerability is not listed in CISA KEV in the record. No confirmed active exploitation appears in the sources consulted. The EPSS probability in the record is 0.00601, and the SSVC exploitation field is recorded as none.

Remediation and mitigation

  • No vendor fix is identified in the sources consulted. Contact Binardat to confirm whether a firmware update or other fix is available.
  • Do not expose the switch management interface to untrusted networks. Restrict access to administrative management networks.
  • Place affected switches behind segmentation and access controls, and limit which hosts can reach the management service.
  • Inventory all devices running V300SP10260209 or earlier, and plan replacement or compensating controls where no fix exists.
  • Treat the built-in credentials as compromised for risk assessment purposes, and monitor for any unexpected administrative access.

Detection guidance

  • Review management logs for administrative logins from unexpected sources or at unusual times.
  • Monitor for unexpected configuration changes, new accounts or changes to device behavior.
  • Alert on management-plane traffic reaching switches from outside approved administrative networks.

Limitations of the available information

  • The record does not list a fixed version, a patch, or a vendor advisory.
  • The sources do not describe how the credentials are stored or what specific administrative functions they expose.
  • The sources consulted do not state whether other Binardat models or firmware branches are affected.
  • The EPSS and SSVC values are point-in-time data and may change.

Frequently asked questions

What is the vulnerability in CVE-2026-27507?

The Binardat 10G08-0800GSM switch firmware V300SP10260209 and earlier contains hard-coded administrative credentials that users cannot change. Knowing them grants full administrative access.

Is a fix available?

The record does not list a fixed version. Contact Binardat to confirm whether an update exists.

Is this vulnerability being actively exploited?

The vulnerability is not listed in CISA KEV in the record, and no confirmed active exploitation appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.