CVE-2026-25601: Metronik MEPIS RM Hardcoded Credentials Vulnerability

CVE-2026-25601 – MEPIS RM Credential Exposure Vulnerability Summary Vulnerability Overview Vulnerability Name: CVE-2026-25601 Vulnerability Type: Credential Exposure / Use of Hard-coded Credentials (CWE-798) CVSS Score: 6.4 (CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H) Description: Discovered in the industrial software product MEPIS RM, developed by Metronik. The application contains a hard-coded encryption key within the component. When the option to store domain passwords is enabled, this key is used to encrypt passwords before storing them in the application database. An attacker with sufficient permissions to access the database can extract the encrypted passwords, decrypt them using the embedded key, and gain unauthorized access to the associated ICS/OT environment. Affected Versions The following versions of MEPIS RM are vulnerable: MEPIS RM 8.0.0.007 (No longer deployed in customer environments) MEPIS RM 8.1.0.007 (No longer deployed in customer environments) MEPIS RM 8.2.0.007 (Build 14 and below) - Vulnerable due to the use of a hard-coded key in the component. Remediation Affected Version Fix: The vulnerability is effectively resolved in MEPIS RM 8.2.0.007 Build 15. Fully Integrated Fix: The final integrated product-level fix will be delivered in MEPIS RM 8.2.0.107. Recommended Action: Upgrading to the aforementioned fixed versions will remove the hard-coded key and introduce a secure password handling mechanism. Exploitation Status**: There are currently no known exploits for this vulnerability in circulation.

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2026-25601: Metronik MEPIS RM Hardcoded Credentials Vulnerability