During the initialisation of a fresh installation, a default administrator account is created with the password "sipcapture" and stored as a legacy SHA‑256 hash. Because the software does not enforce a password change upon first login, any party that can reach the login endpoint is able to authenticate as an administrator and obtain full control over the system, bypassing all other safeguards.

The affected product is the open source telemetry system "Homer" from the vendor sipcapture. Versions prior to 11.0.283 contain the vulnerable bootstrap process. Version 11.0.283 and later implement the fix and do not include the hard‑coded password.

The vulnerability carries a CVSS score of 9.8, indicating high severity. The EPSS score is currently not available, and the vulnerability has not been listed in CISA’s KEV catalogue. Based on the description, the likely attack vector is any user who can access the login interface, which could include local network users or remote attackers if the service is exposed. An attacker exploiting this flaw achieves absolute administrative rights, enabling deployment of arbitrary code, data exfiltration, or service disruption.