CVE-2026-25803 3DP-MANAGER Uses Hard-coded Credentials
Attackers can gain full administrative control of 3DP-MANAGER by using known default credentials, allowing them to manage VPN tunnels and system settings.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-25803?
CVE-2026-25803 is a critical vulnerability in denpiligrim 3dp-manager, published on 6 Feb 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
3DP-MANAGER is an inbound generator for 3x-ui. In version 2.0.1 and prior, the application automatically creates an administrative account with known default credentials (admin/admin) upon the first initialization. Attackers with network access to the application's login interface can gain full administrative control, managing VPN tunnels and system settings. This issue will be patched in version 2.0.2.
Weakness: CWE-798
Which versions are affected by CVE-2026-25803?
It affects 1 product.
Products include Denpiligrim 3dp-Manager.
How do I fix CVE-2026-25803?
No fix has been published for CVE-2026-25803 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-25803 being exploited?
There is no known exploitation of CVE-2026-25803 in the wild and no public exploit code.
Sources
Also known as GHSA-5x57-h7cw-9jmw.