CVE-2025-10681 — Storage credentials are hardcoded in the mobile app and device firmware. These…
Image via opengraph.githubassets.com
🚨 CVE-2025-10681 Storage credentials are hardcoded in the mobile app and device firmware. These credentials do not adequately limit end user permissions and do not expire within a reasonable amount of time. This vulnerability may grant unauthorized access to production storage containers.
What This Means For You
- New vulnerability disclosed — verify if your stack is exposed.
- Phishing or social engineering activity — brief your users and SOC team.
Indicators of Compromise
| ID | Type | Indicator |
|---|---|---|
| CVE-2025-10681 | Misconfiguration | Mobile app and device firmware with hardcoded storage credentials. These credentials do not adequately limit end user permissions and do not expire within a reasonable amount of time, potentially granting unauthorized access to production storage containers. |
Source & Attribution
| Source Platform | Telegram |
| Channel | CVE Notify |
| Published | April 04, 2026 at 00:26 UTC |
This content was curated and summarized by Shimi's Cyber World for informational purposes. It is not copied or republished in full. All intellectual property rights remain with the original author and source.
Believe this infringes your rights? Submit a takedown request.
Related coverage
CVE-2026-20240 — Denial of Service
CVE-2026-20240 — In Splunk Enterprise versions below 10.2.2, 10.0.5, 9.4.11, and 9.3.12, and Splunk Cloud Platform versions below 10.4.2603.1, 10.3.2512.9, 10.2.2510.11, 10.1.2507.21, 10.0.2503.13, and 9.3.2411.129,...
Splunk Enterprise, Cloud Vulnerability Exposes Session Cookies, Sensitive Data
CVE-2026-20239 — In Splunk Enterprise versions below 10.2.2 and 10.0.5, and Splunk Cloud Platform versions below 10.3.2512.8, 10.2.2510.11, 10.1.2507.21, and 10.0.2503.13, a user with a...
CVE-2026-20238 — In Splunk AI Toolkit versions below 5.7.3, a low-privileged
CVE-2026-20238 — In Splunk AI Toolkit versions below 5.7.3, a low-privileged user that does not hold the 'admin' or 'power' roles could access confidential data...