VulnSocial

CVE-2026-18452Patch

LOWCVSS 10.0 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

DMS+ (Non-Mobile) developed by Rich Source has a Use of Hard-coded Credentials vulnerability. Unauthenticated remote attackers can exploit a fixed API key to gain control over all installed DMS+ devices.

Back to dashboard
0.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-798

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

  • Patch or workaround signal is available
  • 3 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 2 signals
  • Technical details provided in 3 signals
  • Disclosure: 1 classified signal
  • Peaked 1d ago at 2 mentions (2026-07-31); latest day: 1
  • 3 total mentions across 2 days

Deep dive

Activity timeline3 mentions / 2d
01122Mentions · 2026-07-31: 2Mentions · 2026-08-01: 1Patch / Workaround · 2026-07-31: 2Technical Details · 2026-07-31: 2Technical Details · 2026-08-01: 107-3108-01
Signal classification2 categories
Patch
266.7%
Disclosure
133.3%
Referenced assets2 URLs
Classification over time
DateTotalLabels
2026-07-312
Patch2
2026-08-011
Disclosure1
Full discourse3 posts
  • SecAlerts@SecAlertsCo
    Disclosure

    🔑 Fixed API key = full device takeover. CVE-2026-18452 in Rich Source DMS+ exposes a hard-coded credential flaw letting unauthenticated attackers remotely control every DMS+ device. CVSS 10. #cybersecurity #vulnerabilities #ciso #cto #mssp https://secalerts.co/vulnerability/CVE-2026-18452?utm_campaign=x https://t.co/v4I0g544pX

    Post summary

    The post announces a new high‑severity CVE involving a hard‑coded credential flaw that allows unauthenticated remote control of Rich Source DMS+ devices, but it does not provide exploit code, active exploitation evidence, or mitigation details.

    00000193
    871 followersView on X
  • ThreatAft@ThreatAft
    Patch

    🔐🚨 DMS+ Hardcoded API Key — CVSS 9.8 CVE-2026-18452: Unauthenticated device takeover via fixed API key in Rich Source DMS+. Update to 5.64 NOW. → http://threataft.com/articles/rich-source-dms-cve-2026-18452 #cybersecurity #infosec #DMS #DigitalSignage #ThreatIntel

    Post summary

    The tweet reports a high‑severity vulnerability in Rich Source DMS+ and urges users to apply the update (v5.64); it does not provide PoC, exploit code, or evidence of active exploitation.

    0000060
    35 followersView on X
  • Upwind Security MDR@UpwindMDR
    Patch

    🚨Critical - Rich Source DMS+ Hard-coded API Key Device Takeover (CVE-2026-18452) Rich Source DMS+ (Non-Mobile) ships with a fixed API key (hard-coded credential) that enables unauthenticated remote API access. Attackers can reuse the key to authenticate and remotely take control of all installed DMS+ devices. Mobile editions are not affected. 👉Affected: Rich Source DMS+ (Non-Mobile) <= 5.63 | Upgrade to 5.64

    Post summary

    The update notes a hard‑coded API key vulnerability that allows remote takeover of Rich Source DMS+ devices, and a patch is available in version 5.64.

    0000072
    275 followersView on X

Explore more

Back to dashboard