CVE-2026-62252: Sipcapture Homer: Hard-coded Default Admin Password
Homer, an open source telecom observability platform, creates an admin account with a known default password on fresh deployments that use internal authentication, and does not force a password change at first login. The record rates this as critical (CVSS 9.8) and classifies it as CWE-798. Version 11.0.283 is identified as the patched release.
Overview
Homer is open source telecom observability software. According to the GitHub Security Advisory and the CVE record, fresh deployments that use internal authentication automatically create an administrative account with a known default password, and the system does not require that password to be changed at first login.
Impact
- Anyone who can reach the login interface may authenticate as the administrator, which the record describes as full administrative access.
- The record assigns a critical severity with a CVSS base score of 9.8 and high impact on confidentiality, integrity and availability.
- The weakness is classified as CWE-798, use of hard-coded credentials.
Affected products and versions
- Sipcapture Homer, versions before 11.0.283, according to the record.
- The record lists 11.0.283 as the version that patches the issue. The lower bound of the affected range is not stated.
Exploitation status
No confirmed exploitation appears in the sources consulted. The record shows that this CVE is not listed in the CISA KEV catalog. The SSVC data in the record marks exploitation as 'poc', which suggests proof-of-concept material is considered available. That is not evidence of attacks in the wild. The EPSS probability is 0.00653 (percentile 0.50667), dated 2026-10-23.
Remediation and mitigation
- Upgrade Homer to version 11.0.283, the release the record identifies as the fix.
- Until the upgrade is done, restrict network access to the login interface to trusted administrators only.
- Check whether the default administrator account still exists with its original password, and rotate that credential immediately.
- Review administrative accounts and recent logins on any deployment that was reachable with default credentials, and treat suspicious activity as a possible compromise.
Detection guidance
- Review authentication logs for successful logins to administrative accounts from unexpected sources or at unusual times.
- Inventory accounts created during initial bootstrap and confirm that their passwords were changed.
- Monitor for administrative configuration changes or new accounts that follow an unexpected login.
Limitations of the available information
- The record does not include technical reproduction details, and this analysis is based only on its description and the listed references.
- The patch commit and release notes are referenced, but their contents were not independently verified here.
- The record does not show whether operators have already changed the default password on their deployments.
- The lower bound of the affected version range is not provided.
Frequently asked questions
What is the core problem in CVE-2026-62252?
Fresh Homer deployments that use internal authentication create an admin account with a known default password, and the system does not force a change at first login.
Which version fixes this issue?
The record identifies version 11.0.283 as the patched release. Versions before 11.0.283 are listed as affected.
Is this vulnerability known to be exploited in the wild?
No confirmed exploitation appears in the sources consulted, and the record shows the CVE is not listed in CISA KEV. The SSVC data marks exploitation as poc.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.