The vulnerability is a hard‑coded credentials flaw in the MR‑GM5L‑S1 and MR‑GM5A‑L1 devices, catalogued as CWE-798. It enables an attacker who can reach the device’s management interface to log in with predetermined credentials and gain full administrative control, potentially allowing configuration changes, data exfiltration, or deployment of malicious firmware.

Vendor: Micro Research Ltd. Products: MR‑GM5L‑S1 and MR‑GM5A‑L1. Specific affected firmware versions are not listed in the CVE record, so all firmware variants of these models should be considered vulnerable until the vendor publishes a fix.

The CVSS score of 9.3 indicates critical severity, while the EPSS score of less than 1% suggests low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Exploitation is possible over the network due to the presence of hard‑coded credentials; no additional authentication is required beyond accessing the device’s administrative interface.