CVE-2026-62252

9.8 Critique

Publiée le 07/10/2026 à 19:16 · Modifiée le 08/10/2026 à 23:09 · En attente d'analyse NVD · Source : security-advisories@github.com

Description

Homer is open source telecom observability software. Prior to version 11.0.283, on every fresh Homer deployment using internal authentication, the bootstrap process automatically creates an `admin` account with the password `sipcapture` (stored as a legacy SHA-256 hex hash). There is no first-login forced-change mechanism. Any attacker who reaches the login endpoint immediately gains full administrative access. Version 11.0.283 patches the issue.

Traduire en français

Produits concernés

sipcapture homer

Scores CVSS

Version	Score	Source	Vecteur
3.1	9.8 Critique	security-advisories@github.com	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`

Faiblesses (CWE)

CWE-798

Références

https://github.com/sipcapture/homer/commit/b2e942031ff8cd7435a244ebef306ee97d16b809
https://github.com/sipcapture/homer/pull/838
https://github.com/sipcapture/homer/releases/tag/11.0.283
https://github.com/sipcapture/homer/security/advisories/GHSA-6xp5-7rcx-xfgx
https://github.com/sipcapture/homer/security/advisories/GHSA-6xp5-7rcx-xfgx

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories