SmartIT Desktop Manager, developed by Lightstar, contains a Use of Hard‑coded Credentials flaw (CWE‑798). The vulnerability allows unauthenticated remote attackers to use a known, fixed password to gain remote access to user hosts.

The flaw affects Lightstar’s SmartIT Desktop Manager. All installations of this product that have not been updated to version 11 or later are vulnerable. The vendor’s advisory identifies affected builds.

The CVSS score of 9.3 indicates high severity, and the absence of an EPSS score means that current estimation of exploitation probability is unavailable. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote; unauthenticated attackers can submit authentication requests to the management service over the network and exploit the fixed password once learned, making exploitation straightforward for exposed or poorly secured systems.