CVE-2026-103548 - Vulnerability Details - OpenCVE

Improperly stored passwords in the config file in Itron MV-90 xi 3.0 allows attackers to decode the passwords and password histories to gain access to the MV-90 application as any user.

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact High

Subsequent System Integrity Impact High

Subsequent System Availability Impact High

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Exploitation none

Automatable no

Technical Impact partial

No data.

No data.

No data.

No data.

Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://github.com/PaloAltoNetworks/u42-vulnerability-disclosures/commits/main/2026/PANW-2026-0002/PANW-2026-0002.md

History

Wed, 30 Sep 2026 20:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Wed, 30 Sep 2026 20:00:00 +0000

Type	Values Removed	Values Added
Description		Improperly stored passwords in the config file in Itron MV-90 xi 3.0 allows attackers to decode the passwords and password histories to gain access to the MV-90 application as any user.
Title		Improperly Stored Credentials
Weaknesses		CWE-257 CWE-260 CWE-261
References		https://github.com/PaloAltoNetworks/u42-vulnerability-disclosures/commits/main/2026/PANW-2026-0002/PANW-2026-0002.md
Metrics		cvssV4_0 `{'score': 5.3, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:L/SC:H/SI:H/SA:H/E:P'}`

Projects

Sign in to view the affected projects.

MITRE

Status: PUBLISHED

Assigner: palo_alto

Published: 2026-09-30T19:45:14.182Z

Updated: 2026-09-30T19:56:27.037Z

Reserved: 2026-09-30T19:41:47.582Z

Link: CVE-2026-103548

Vulnrichment

Updated: 2026-09-30T19:56:20.992Z

NVD

Status : Received

Published: 2026-09-30T20:17:31.957

Modified: 2026-09-30T20:17:31.957

Link: CVE-2026-103548

Redhat

No data.

OpenCVE Enrichment

No data.

Weaknesses

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-103548", "assignerOrgId": "d6c1279f-00f6-4ef7-9217-f89ffe703ec0", "state": "PUBLISHED", "assignerShortName": "palo_alto", "dateReserved": "2026-09-30T19:41:47.582Z", "datePublished": "2026-09-30T19:45:14.182Z", "dateUpdated": "2026-09-30T19:56:27.037Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "d6c1279f-00f6-4ef7-9217-f89ffe703ec0", "shortName": "palo_alto", "dateUpdated": "2026-09-30T19:47:24.494Z"}, "title": "Improperly Stored Credentials", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-257", "description": "CWE-257 Storing passwords in a recoverable format", "type": "CWE"}]}, {"descriptions": [{"lang": "en", "cweId": "CWE-260", "description": "CWE-260 Password in configuration file", "type": "CWE"}]}, {"descriptions": [{"lang": "en", "cweId": "CWE-261", "description": "CWE-261 Weak encoding for password", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-233", "descriptions": [{"lang": "en", "value": "CAPEC-233 Privilege Escalation"}]}], "affected": [{"vendor": "Itron", "product": "MV-90 xi", "platforms": ["Windows"], "versions": [{"status": "affected", "version": "3.0"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "Improperly stored passwords in the config file in Itron MV-90 xi 3.0 allows attackers to decode the passwords and password histories to gain access to the MV-90 application as any user.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Improperly stored passwords in the config file in Itron MV-90 xi 3.0 allows attackers to decode the passwords and password histories to gain access to the MV-90 application as any user."}]}], "references": [{"url": "https://github.com/PaloAltoNetworks/u42-vulnerability-disclosures/commits/main/2026/PANW-2026-0002/PANW-2026-0002.md"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "LOCAL", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "LOW", "subConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "subIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "LOW", "subAvailabilityImpact": "HIGH", "exploitMaturity": "PROOF_OF_CONCEPT", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "MEDIUM", "baseScore": 5.3, "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:L/SC:H/SI:H/SA:H/E:P"}}], "credits": [{"lang": "en", "value": "Menachem (Momo) Rothbart", "type": "finder"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.4"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-09-30T19:56:02.841585Z", "id": "CVE-2026-103548", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-30T19:56:27.037Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-103548", "assignerOrgId": "d6c1279f-00f6-4ef7-9217-f89ffe703ec0", "state": "PUBLISHED", "assignerShortName": "palo_alto", "dateReserved": "2026-09-30T19:41:47.582Z", "datePublished": "2026-09-30T19:45:14.182Z", "dateUpdated": "2026-09-30T19:56:27.037Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "d6c1279f-00f6-4ef7-9217-f89ffe703ec0", "shortName": "palo_alto", "dateUpdated": "2026-09-30T19:47:24.494Z"}, "title": "Improperly Stored Credentials", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-257", "description": "CWE-257 Storing passwords in a recoverable format", "type": "CWE"}]}, {"descriptions": [{"lang": "en", "cweId": "CWE-260", "description": "CWE-260 Password in configuration file", "type": "CWE"}]}, {"descriptions": [{"lang": "en", "cweId": "CWE-261", "description": "CWE-261 Weak encoding for password", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-233", "descriptions": [{"lang": "en", "value": "CAPEC-233 Privilege Escalation"}]}], "affected": [{"vendor": "Itron", "product": "MV-90 xi", "platforms": ["Windows"], "versions": [{"status": "affected", "version": "3.0"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "Improperly stored passwords in the config file in Itron MV-90 xi 3.0 allows attackers to decode the passwords and password histories to gain access to the MV-90 application as any user.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Improperly stored passwords in the config file in Itron MV-90 xi 3.0 allows attackers to decode the passwords and password histories to gain access to the MV-90 application as any user."}]}], "references": [{"url": "https://github.com/PaloAltoNetworks/u42-vulnerability-disclosures/commits/main/2026/PANW-2026-0002/PANW-2026-0002.md"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "LOCAL", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "LOW", "subConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "subIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "LOW", "subAvailabilityImpact": "HIGH", "exploitMaturity": "PROOF_OF_CONCEPT", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "MEDIUM", "baseScore": 5.3, "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:L/SC:H/SI:H/SA:H/E:P"}}], "credits": [{"lang": "en", "value": "Menachem (Momo) Rothbart", "type": "finder"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.4"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-103548", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-30T19:56:02.841585Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-30T19:56:20.992Z"}}]}}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "platforms": ["Windows"], "product": "MV-90 xi", "vendor": "Itron", "versions": [{"status": "affected", "version": "3.0"}]}], "source": "[email protected]"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Improperly stored passwords in the config file in Itron MV-90 xi 3.0 allows attackers to decode the passwords and password histories to gain access to the MV-90 application as any user."}], "id": "CVE-2026-103548", "lastModified": "2026-09-30T20:17:31.957", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:L/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "[email protected]", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-103548", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-09-30T19:56:02.841585Z", "version": "2.0.3"}}]}, "published": "2026-09-30T20:17:31.957", "references": [{"source": "[email protected]", "url": "https://github.com/PaloAltoNetworks/u42-vulnerability-disclosures/commits/main/2026/PANW-2026-0002/PANW-2026-0002.md"}], "sourceIdentifier": "[email protected]", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-257"}, {"lang": "en", "value": "CWE-260"}, {"lang": "en", "value": "CWE-261"}], "source": "[email protected]", "type": "Secondary"}]}