【Vulnerability Alert】ShengYuan｜DMS+ (Non-Mobile) - Use of Hard-coded Credentials

• Subject: 【Vulnerability Alert】ShengYuan｜DMS+ (Non-Mobile) - Use of Hard-coded Credentials

• Description:
  • Forwarded Security Alert from TWCERT/CC (Taiwan Computer Emergency Response Team/Coordination Center) TWCERTCC-200-202608-00000002
  • 【ShengYuan｜DMS+ (Non-Mobile) - Use of Hard-coded Credentials】(CVE-2026-18452, CVSS: 10.0) ShengYuan DMS+ (Non-Mobile) contains a Use of Hard-coded Credentials vulnerability. An unauthenticated remote attacker can exploit a fixed API KEY to obtain control of all devices with DMS+ installed.
• Affected Platforms:
  • DMS+ (Non-Mobile) version 563 and prior
• Recommendations:
  • Please update to version 5.64 or later
• Reference Information:
  1. https://www.twcert.org.tw/tw/cp-132-11072-3a4d4-1.html

Computer and Communication Center
Network Systems Division