CVE-2026-62252: critical vulnerability in sipcapture homer
Homer: Hardcoded Default Admin Password 'sipcapture' With No Forced Change on First Login
Published
25Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 9.8
exploitation probability
—
observed exploitation
nono source reports it
Homer is open source telecom observability software. Prior to version 11.0.283, on every fresh Homer deployment using internal authentication, the bootstrap process automatically creates an `admin` account with the password `sipcapture` (stored as a legacy SHA-256 hex hash). There is no first-login forced-change mechanism. Any attacker who reaches the login endpoint immediately gains full administrative access. Version 11.0.283 patches the issue.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
sipcapture · homerRelated CVEs — sipcapture homer
In the same product, most dangerous first.