The RBG‑100 recycler system incorporates hard‑coded operating system credentials within its ISPK‑08 component. These embedded passwords enable an attacker with network access to authenticate to the underlying Linux system, even though no valid login session would ordinarily be possible. Because many of the embedded accounts hold administrative privileges, successful authentication leads to elevated access and ultimately full system compromise. This weakness is a classic instance of insecure credential storage, classified under CWE‑798.

Glory Global Solutions RBG‑100 recycler systems that use the ISPK‑08 software component are impacted. Multiple local user accounts, including those with administrative rights, contain fixed, embedded passwords.

The vulnerability carries a CVSS score of 9.3, indicating a high severity for remote privilege escalation. The EPSS score is lower than 1%, suggesting that current exploitation attempts appear uncommon, yet the possibility remains. It is not listed in the CISA Known Exploited Vulnerabilities catalog. The likely attack vector is through exposed network services such as SSH, where an attacker can supply the hard‑coded credentials to gain unauthenticated remote access and then elevate privileges.