The PrismX MX100 AP controller contains hard‑coded database credentials that allow unauthenticated remote attackers to log in to the internal database. This flaw enables attackers to read or modify configuration data and potentially exfiltrate or alter operational settings, compromising confidentiality and integrity of all managed access points. The vulnerability is a classic example of improper credential storage (CWE-798).

All BROWAN COMMUNICATIONS PrismX MX100 AP controller firmware releases earlier than v1.03.23.01 are affected. The vulnerability is present in devices shipped with the default firmware that includes the hard‑coded credentials.

With a CVSS score of 9.3 the flaw is classified as critical. The EPSS score is reported below 1%, indicating that exploitation in the wild is unlikely at present, and the vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the weakness remotely by connecting to the device over the network; no special user privileges are required. Successful exploitation would give full read/write access to the device’s database, enabling configuration tampering or information disclosure.