Read the docs
TI-2026-84995 Aliases CVE-2026-94459GHSA-6vch-q8gf-52qp

Default accounts with predictable credentials in IRISPowerscan

Priority LOW 31CWE-1392Published · Updated

Key facts

Attack vector
Adjacent network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
Low · Low · High
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

I.R.I.S S.A. IRISPowerscan through 12.3 contains default user accounts with predictable credentials (CWE-1392). An unauthenticated attacker with access to an affected installation can use these credentials to log in and access functionality available to the affected accounts, which can lead to unauthorised access or modification of application data and configuration.

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

Description from the CNA

IRISPowerscan contain default user accounts with predictable credentials. An unauthenticated attacker with access to an affected installation could use these credentials to authenticate to the application and access functionality available to the affected accounts, potentially resulting in unauthorised access or modification of application data and configuration.

Why it matters now

EPSS 0.0015 4th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
I.R.I.S S.A.IRISPowerscanup to 12.3—No fix listedCNA
  • IRISPowerscan VendorI.R.I.S S.A. Affected up to 12.3 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for IRISPowerscan.

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

Timeline

  1. 2026-11-04 Threatist record created from CVE-2026-94459
  2. 2026-11-04 Alias added: GHSA-6vch-q8gf-52qp
  3. 2026-11-05 Priority changed: MEDIUM → LOW

References

Patch 1

  • TI-2026-84996 Insecure default privilege assignment in IRISPowerscan CVSS 4.0HIGH 7.2
  • TI-2026-84997 Untrusted scripts in IRISPowerscan allow arbitrary code execution CVSS 4.0MEDIUM 6.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences