SmartIT Desktop Manager contains hard‑coded SSH service account credentials in its source code. An unauthenticated attacker can retrieve the credentials by accessing the code, enabling direct SSH access to the SmartIT Agent without any authentication. The weakness is a type of Improper Authentication (CWE‑798) that permits an attacker to obtain valid login credentials. Because no authentication is required, the attack vector is remote. The CVSS score of 9.3 indicates a critical severity, but the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalogue.

Lightstar SmartIT Desktop Manager – any installed version prior to 11.0 is affected. The vendor recommends updating to version 11 or later.

With a critical CVSS score of 9.3, the risk to affected deployments is high. The lack of an EPSS score means current exploitation probability is unknown, but the absence of KEV listing suggests no public exploitation is confirmed yet. Nevertheless, the capability to obtain SSH credentials remotely means attackers could gain full control of the agent, potentially compromising any connected systems if not isolated. The straightforward nature of the vulnerability—simply reading source code—makes it exploitable by anyone with network visibility or ability to download the code.