CVE-2026-1221: BROWAN COMMUNICATIONS ｜PrismX MX100 AP controller - Use of Hard-coded Credentials

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-01-20 · updated 2026-06-17
Weakness: CWE-798

Description

PrismX MX100 AP controller developed by BROWAN COMMUNICATIONS has a Use of Hard-coded Credentials vulnerability, allowing unauthenticated remote attackers to log in to the database using hardcoded database credentials stored in the firmware.

Affected products

BROWAN COMMUNICATIONS PrismX MX100 AP controller: before 1.03.23.01 — fixed in 1.03.23.01

How to fix

Upgrade to a fixed version: BROWAN COMMUNICATIONS PrismX MX100 AP controller 1.03.23.01. Check the vendor advisory for mitigations.

References

https://www.twcert.org.tw/en/cp-139-10643-2f8d7-2.html
https://www.twcert.org.tw/tw/cp-132-10642-3b808-1.html

Get alerted when CVE-2026-1221 or the next vulnerability affects your stack