For awareness Medium Check exposure in your normal cycle
VEGA firmware configuration interface exposes credential hashes to low-rights users
CERT@VDE advisoriesVEGA
What happened. Vulnerable VEGA firmware has an unsecured configuration interface. Users with no or low rights can retrieve information such as hashed credentials. An attacker could use it to impersonate authorised users. Advisory ID is VDE-2026-016.
Who is affected. Users of VEGA devices running the vulnerable firmware releases. The report does not list the exact products or versions.
What to do. Check whether you run VEGA devices, then follow advisory VDE-2026-016 to find the affected firmware and apply the vendor fix.
When to act. For awareness: no known exploitation and no score stated
Editor's reading
Forasset ownerOT security lead
- Purdue level
- L2
- L1
Why: VEGA devices with firmware and a configuration interface are field instruments or similar devices, so L1 and L2 are a reading; the report does not state a level.
- Are you exposed?
Check your asset inventory for VEGA devices and compare their firmware releases with those listed in advisory VDE-2026-016.
- If you cannot fix it yet
- Restrict access to the device configuration interface to known engineering hosts.
- Change credentials on affected devices once the firmware is fixed, as hashes may have been exposed.
- Watch for
- Configuration interface requests to VEGA devices from hosts that are not engineering workstations.
- Logons to VEGA devices using accounts from unexpected sources, which could mean stolen credentials in use.
Inferred from the facts above, not stated by the source. Check it against your own site before acting.