CVE-2026-96587 Viidure Android - Hardcoded Credentials

Viidure Android application contains hardcoded plaintext cloud storage credentials in its compiled code, letting attackers access and modify critical platform storage including firmware and application binaries, exploit requires access to the app binary.

CVSS base score 10.0 /10
Critical
CISA KEV
Not listed
Public exploit
None known
EPSS
0.34% chance of exploitation in 30 days
View the NVD record ↗

Details

Type
Hardcoded Credentials
Impact
Information Disclosure, Data Tampering
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Published
29 September 2026
Updated
15 October 2026
Weakness
CWE-798

Vendor fix

Remove hardcoded credentials and implement secure credential storage; update to a version without embedded plaintext credentials.

Patching closes this CVE. It does not tell you which of your systems run the affected version, or what else is exposed alongside them.

References

← All CVEs