CVE-2025-57174Critical· 9.8▾ AbyssalPoC availableAn issue was discovered in Siklu Communications Etherhaul 8010TX and 1200FX devices, Firmware 7.4.0 through 10.7.3 and possibly other previous versions. The rfpiped service listening on TCP port 555 which uses static AES encryption keys …
▾ Abyssal zone — Critical with a public exploit or in-the-wild use
impact 53.9 · likelihood 0.4 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 2 sources. Availability, not in-the-wild use.
Exploit-prediction probability, daily snapshots since Aug 2.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
2.1%
2.1% → 2.2%
Exploit-DB · 1 GitHub repo (last check)
An issue was discovered in Siklu Communications Etherhaul 8010TX and 1200FX devices, Firmware 7.4.0 through 10.7.3 and possibly other previous versions. The rfpiped service listening on TCP port 555 which uses static AES encryption keys hardcoded in the binary. These keys are identical across all devices, allowing attackers to craft encrypted packets that execute arbitrary commands without authentication. This is a failed patch for CVE-2017-7318. This issue may affect other Etherhaul series devices with shared firmware.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-112345High· 8.1TTLock Android App < 9.8.260718 Hardcoded BLE Pairing Key Exposure
CVE-2026-113466Medium· 5.3MinIO Embedded Console common-main.go SessionTokenAuthenticate hard-coded key
CVE-2026-111612High· 7.5netdisk-fast-download through 0.4.8 contains an information disclosure vulnerability that allows unauthenticated attackers to retrieve donated netdisk credentials via the /v2/randomAuth endpoint in ParserApi
CVE-2026-111633High· 8.6ZKEACMS through 4.4 Authentication Bypass via Hard-Coded JWT Signing Key
CVE-2026-111642High· 8.8FastapiAdmin through 3.0 contains a hard-coded JWT signing secret in backend/app/config/setting.py that allows low-privileged users to forge tokens impersonating the superuser
CVE-2026-111690Critical· 9.8Simple Admin Core through 1.8.7 Hard-Coded JWT Secret Authentication Bypass