CVE-2026-73778 in AOS-CX
Summary
by MITRE • 09/02/2026
A vulnerability exists in the Credential Manager component that may allow for unauthorized administrative access. An unauthenticated remote attacker could exploit this vulnerability on a device in its factory-default or post-ZTP state before any administrator has configured credentials by providing a predictable factory-default password. Successful exploitation could result in full administrative control of the affected device during the initial setup process.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/02/2026
The identified vulnerability resides within the Credential Manager component of the target system, presenting a critical risk to organizational security posture during the device initialization phase. This flaw is characterized by the use of predictable factory-default credentials that remain active and unmodified in devices operating in their default state or immediately after Zero Touch Provisioning (ZTP) completion. The core technical deficiency lies in the failure to enforce mandatory credential rotation or require user interaction for password change prior to allowing administrative access. Consequently, any entity capable of network connectivity to the device can leverage these static, well-known credentials to authenticate as an administrator without providing valid proof of identity. This represents a fundamental breakdown in secure configuration management and default security hygiene standards.
From an operational perspective, this vulnerability allows unauthenticated remote attackers to gain full administrative control over the affected device before any legitimate administrator has had the opportunity to configure unique, strong passwords. The window of exposure is particularly dangerous because it occurs during the initial setup process, a period when devices are often deployed in less secure network segments or directly connected to management networks without additional security controls such as firewalls or intrusion detection systems active for that specific host. Once exploited, an attacker can execute arbitrary commands, modify system configurations, install malicious software, pivot to other internal assets, and exfiltrate sensitive data stored on the device. The impact is severe because administrative access typically grants unrestricted control over network infrastructure, potentially leading to widespread service disruption or complete compromise of the underlying environment.
This vulnerability aligns with CWE-798: Use of Hard-coded Credentials, specifically where default credentials are not changed upon first use. It also maps directly to MITRE ATT&CK technique T1078: Valid Accounts, as it involves the exploitation of legitimate account privileges that were never secured by human intervention. Furthermore, the scenario reflects CWE-256: Unprotected Storage of Credentials if the factory password is stored in a manner accessible to attackers prior to authentication attempts. The lack of enforced credential change during ZTP or post-deployment initialization violates best practices outlined in NIST SP 800-123 and CIS Benchmarks, which mandate that default passwords be changed immediately upon installation or first login.
Mitigation strategies must focus on eliminating the possibility of using predictable defaults. Vendors should implement mechanisms that force a password change during the initial configuration wizard before any administrative functions are enabled. For existing deployments, immediate remediation involves auditing all devices in factory-default states and manually updating credentials to complex, unique passwords. Network segmentation is also critical; management interfaces should be isolated from general user networks using firewalls or VLANs restricted to authorized IP addresses only. Additionally, implementing multi-factor authentication for administrative access can provide a secondary layer of defense even if default credentials are compromised. Regular vulnerability scanning focused on detecting open ports associated with management protocols and verifying credential policies will help identify devices that remain in this vulnerable state.