LTSecurity LTK3500SF firmware contains hard-coded root and guest account passwords stored as weak hashes in /etc/shadow, recoverable with dictionary-based cracking tools. An attacker who obtains these credentials can authenticate via Telnet or SSH, thereby gaining full root-level access to the operating system. Because Telnet and SSH are not confirmed to start automatically at boot, exploitation requires these services to be running, either enabled in device configuration or started manually. This credential exposure flaw is CWE-798 and directly compromises confidentiality, integrity, and availability.

The affected product is the LTSecurity LTK3500SF network gateway. No specific firmware version range is listed; the vulnerability appears to be present in all builds that retain the hard‑coded credentials. Users should verify which firmware revision their device is running against vendor documentation.

The CVSS score of 9.2 indicates critical severity. Because the credentials are hard‑coded, an attacker only needs network access to the Telnet or SSH service, making exploitation straightforward for anyone who can reach the device. The EPSS score of 0.00512 indicates a very low likelihood of exploitation, and the flaw is not yet listed in the CISA KEV catalog, but the high CVSS and direct authentication vector imply a high risk. Attackers could gain unlimited control over the device, potentially affecting connected network infrastructure.