CVE-2026-62252
9.8 CRITICALpublic exploit availablePublished 2026-10-07 · Updated 2026-10-08
AI risk analysis
- Summary
- The flaw in Homer allows for unauthorized access to the admin account with a hardcoded password, enabling full administrative control.
- Exploitability
- Exploitation is straightforward as the password is hardcoded and no first-login forced-change mechanism is in place.
- Blast radius
- If exploited, the attacker gains full administrative access, potentially leading to complete compromise of the system.
- Detection
- No reliable host or network indicator is derivable from the published description.
- Prioritized remediation
- Upgrade to Homer version 11.0.283 or later.
Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.
NVD description
Homer is open source telecom observability software. Prior to version 11.0.283, on every fresh Homer deployment using internal authentication, the bootstrap process automatically creates an `admin` account with the password `sipcapture` (stored as a legacy SHA-256 hex hash). There is no first-login forced-change mechanism. Any attacker who reaches the login endpoint immediately gains full administrative access. Version 11.0.283 patches the issue.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-798
Public exploit & PoC references
- https://github.com/sipcapture/homer/commit/b2e942031ff8cd7435a244ebef306ee97d16b809
- https://github.com/sipcapture/homer/pull/838
- https://github.com/sipcapture/homer/releases/tag/11.0.283
- https://github.com/sipcapture/homer/security/advisories/GHSA-6xp5-7rcx-xfgx
- https://github.com/sipcapture/homer/security/advisories/GHSA-6xp5-7rcx-xfgx
All references
- https://github.com/sipcapture/homer/commit/b2e942031ff8cd7435a244ebef306ee97d16b809
- https://github.com/sipcapture/homer/pull/838
- https://github.com/sipcapture/homer/releases/tag/11.0.283
- https://github.com/sipcapture/homer/security/advisories/GHSA-6xp5-7rcx-xfgx
- https://github.com/sipcapture/homer/security/advisories/GHSA-6xp5-7rcx-xfgx
Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.
Related CVEs
- CRITICALCVE-2026-105278PoC
- CRITICALCVE-2026-105641PoC
- CRITICALCVE-2026-109566PoC
- CRITICALCVE-2026-71238PoC
- CRITICALCVE-2026-76708
- HIGHCVE-2022-51019PoC
- HIGHCVE-2023-54403PoC
- CRITICALCVE-2025-15399
Related by shared AI tags and CWE weakness class. Browse the full archive.