Description
Improperly stored passwords in the config file in Itron MV-90 xi 3.0 allows attackers to decode the passwords and password histories to gain access to the MV-90 application as any user.
Published: 2026-09-30
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized Access via compromised credentials
Action: Patch immediately
AI Analysis

Impact

The Itron MV-90 xi appliance stores passwords and password histories in an unprotected configuration file. If an attacker obtains this file, they can decode the stored credentials and authenticate to the MV-90 application as any user, giving them full control of the device. This vulnerability aligns with CWE-257, CWE-260, and CWE-261.

Affected Systems

The issue applies to the Itron MV-90 xi series running firmware version 3.0. Only devices with this firmware that expose the configuration file to an attacker are at risk; no other product versions are mentioned.

Risk and Exploitability

The CVSS score of 5.3 indicates medium severity. The EPSS score is not available, so the likelihood of exploitation cannot be quantified, and the vulnerability is not listed in CISA KEV, indicating no confirmed widespread attacks. Based on the description, the attacker would need to read or obtain the configuration file, which could be achieved through local or remote file‑read privileges, exploitation of the device’s remote management interface, or compromise of the operating system that hosts the appliance.

Generated by OpenCVE AI on September 30, 2026 at 23:22 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply any available Itron firmware or patch that addresses the credential storage flaw; ensure the installed revision matches the device’s firmware version.
  • Restrict filesystem permissions on the configuration file so that only privileged system accounts can read it, and enforce strong authentication on any remote management tools to limit file access.
  • If the appliance supports it, enable encryption or obfuscation for stored passwords, or migrate to a dedicated secrets‑management solution to safeguard credentials.
  • Periodically audit the configuration file for unauthorized changes or plaintext credentials and configure alerts for file‑integrity violations.

Generated by OpenCVE AI on September 30, 2026 at 23:22 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 01 Oct 2026 16:00:00 +0000

Type Values Removed Values Added
First Time appeared Itron
Itron mv-90 Xi
Vendors & Products Itron
Itron mv-90 Xi

Wed, 30 Sep 2026 20:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 30 Sep 2026 20:00:00 +0000

Type Values Removed Values Added
Description Improperly stored passwords in the config file in Itron MV-90 xi 3.0 allows attackers to decode the passwords and password histories to gain access to the MV-90 application as any user.
Title Improperly Stored Credentials
Weaknesses CWE-257
CWE-260
CWE-261
References
Metrics cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:L/SC:H/SI:H/SA:H/E:P'}

Subscriptions

Itron Mv-90 Xi
cve-icon MITRE

Status: PUBLISHED

Assigner: palo_alto

Published:

Updated: 2026-09-30T19:56:27.037Z

Reserved: 2026-09-30T19:41:47.582Z

Link: CVE-2026-103548

cve-icon Vulnrichment

Updated: 2026-09-30T19:56:20.992Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-09-30T20:17:31.957

Modified: 2026-10-01T12:41:25.413

Link: CVE-2026-103548

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-01T15:38:22Z

Weaknesses
  • CWE-257

    Storing Passwords in a Recoverable Format

  • CWE-260

    Password in Configuration File

  • CWE-261

    Weak Encoding for Password