CVE-2026-85149mediumCWE-798

CVE-2026-85149: medium-severity vulnerability in Lightstar SmartIT Desktop Manager

Lightstar｜SmartIT Desktop Manager - Use of Hard-coded Credentials

Published

Follow this CVE+ Monitor SmartIT Desktop Manager

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6.9epss 0.4%
SmartIT Desktop Manager developed by Lightstar has a Use of Hard-coded Credentials vulnerability. Unauthenticated remote attackers can obtain the SFTP service credentials of the SmartIT Agent application from the source code, thereby browsing the file system of the user's host.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Affected products
Lightstar · SmartIT Desktop Manager
Related CVEs — Lightstar SmartIT Desktop Manager

In the same product, most dangerous first.

CVE-2026-85148CRITICALLightstar｜SmartIT Desktop Manager - Use of Hard-coded CredentialsEPSS 0.6%CVE-2026-85146CRITICALLightstar｜SmartIT Desktop Manager - Use of Hard-coded CredentialsEPSS 0.6%CVE-2026-85147HIGHLightstar｜SmartIT Desktop Manager - Use of Hard-coded CredentialsEPSS 0.3%