CVE-2026-103548

Improperly Stored Credentials

Published Sep 30, 2026 CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Description

Improperly stored passwords in the config file in Itron MV-90 xi 3.0 allows attackers to decode the passwords and password histories to gain access to the MV-90 application as any user.

Analysis

Technical impact

The Itron MV-90 xi appliance stores passwords and password histories in an unprotected configuration file. If an attacker obtains this file, they can decode the stored credentials and authenticate to the MV-90 application as any user, giving them full control of the device. This vulnerability aligns with CWE-257, CWE-260, and CWE-261.

Affected Systems

The issue applies to the Itron MV-90 xi series running firmware version 3.0. Only devices with this firmware that expose the configuration file to an attacker are at risk; no other product versions are mentioned.

Risk and Exploitability

The CVSS score of 5.3 indicates medium severity. The EPSS score is not available, so the likelihood of exploitation cannot be quantified, and the vulnerability is not listed in CISA KEV, indicating no confirmed widespread attacks. Based on the description, the attacker would need to read or obtain the configuration file, which could be achieved through local or remote file‑read privileges, exploitation of the device’s remote management interface, or compromise of the operating system that hosts the appliance.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Itron

MV-90 xi

unaffected

Version	Status	Constraints
`3.0`	affected	—

No data.

Vendor Product Versions

Itron

Mv-90 Xi

Version	Status	Scheme	Platform
`3.0`	affected	generic	['windows']

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply any available Itron firmware or patch that addresses the credential storage flaw; ensure the installed revision matches the device’s firmware version.
Restrict filesystem permissions on the configuration file so that only privileged system accounts can read it, and enforce strong authentication on any remote management tools to limit file access.
If the appliance supports it, enable encryption or obfuscation for stored passwords, or migrate to a dedicated secrets‑management solution to safeguard credentials.
Periodically audit the configuration file for unauthorized changes or plaintext credentials and configure alerts for file‑integrity violations.

Generated by OpenCVE AI on September 30, 2026 at 23:22 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact High

Subsequent System Integrity Impact High

Subsequent System Availability Impact High

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.096% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://github.com/PaloAltoNetworks/u42-vulnerability-disclosures/commits/main/2026/PANW-2026-0002/PANW-2026-0002.md

History

Oct 1, 2026 4:00 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Itron Itron mv-90 Xi
Vendors & Products		Itron Itron mv-90 Xi

Sep 30, 2026 8:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Sep 30, 2026 8:00 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Improperly stored passwords in the config file in Itron MV-90 xi 3.0 allows attackers to decode the passwords and password histories to gain access to the MV-90 application as any user.
Title		Improperly Stored Credentials
Weaknesses		CWE-257 CWE-260 CWE-261
References		https://github.com/PaloAltoNetworks/u42-vulnerability-disclosures/commits/main/2026/PANW-2026-0002/PANW-2026-0002.md
Metrics		cvssV4_0 `{'score': 5.3, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:L/SC:H/SI:H/SA:H/E:P'}`