CVE-2026-85149: Lightstar｜SmartIT Desktop Manager - Use of Hard-coded Credentials

Severity: medium (CVSS 5.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-09-04 · updated 2026-09-08
Weakness: CWE-798

Description

SmartIT Desktop Manager developed by Lightstar has a Use of Hard-coded Credentials vulnerability. Unauthenticated remote attackers can obtain the SFTP service credentials of the SmartIT Agent application from the source code, thereby browsing the file system of the user's host.

Affected products

Lightstar SmartIT Desktop Manager: through 10

References

https://www.twcert.org.tw/en/cp-139-11177-13ca3-2.html
https://www.twcert.org.tw/tw/cp-132-11176-a4cc2-1.html

Get alerted when CVE-2026-85149 or the next vulnerability affects your stack