CVE-2026-96587

CRITICALCVSS 10.0

Description

The Viidure Android application embeds permanent, plaintext cloud storage credentials within its compiled code. These credentials provide full access to critical platform storage, including the ability to read, modify, or delete operational files such as firmware and application binaries.

Timeline

Published:September 29th, 2026 9:19 PM

Last modified:September 29th, 2026 10:19 PM

CVSS Scoring

CVSS v3: 10.0 (CRITICAL)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Weaknesses (CWE)

CWE-798

References & Reports

Advisories, patches, and third-party reports

https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-272-07.json
https://viidure.app/
https://www.cisa.gov/news-events/ics-advisories/icsa-26-272-07

Source: NIST NVD · Data may lag official sources by up to one minute