Home Assistant Green stores credentials in cleartext, enabling local privilege escalation
Attackers need low-privileged code in a container first; ZDI rates CVE-2026-91131 at CVSS 8.8.
Stories per day · 30 days
2 stories, newest first · one card per story
Stories tagged #cleartext-credentials
Tycon Systems TPDIN-Monitor-WEB2 (Update A)
CISA details CVE-2026-61884 (CVSS 9.8) in Tycon Systems TPDIN-Monitor-WEB2: unauthenticated access to power relays when credentials are unset; fixed in 2.4.5.
1