The vulnerability causes the 3DP-MANAGER application to create an administrative account with the default credentials admin/admin during first initialization. An attacker who can reach the login interface can authenticate as an administrator, gaining full control over VPN tunnels, system settings, and other privileged functions. The weakness is a hard‑coded credential flaw with high potential impact on confidentiality, integrity and availability.

The affected product is denpiligrim 3dp-manager, specifically all releases up to and including version 2.0.1. The security advisory states that the issue will be patched in version 2.0.2. No other affected versions are listed.

The CVSS base score is 9.8, indicating critical severity. The EPSS score is reported as < 1 %, suggesting a low probability of exploitation, but the vulnerability remains critical because it allows full administrative control. The issue is not listed in the CISA KEV catalog, but the potential impact justifies immediate attention. The likely attack vector is through the network‑accessible login interface, where attackers can supply the known default credentials.