DMS+ (Non-Mobile) has a critical hard-coded credentials flaw in version 5.63 and earlier; update to 5.64 or later.
TWCERT/CC’s published TVN-202607007 indicates that Rich Source-developed DMS+ (Non-Mobile) has a Use of Hard-coded Credentials vulnerability, corresponding to CVE-2026-18452, with a CVSS score of 10 (Critical). Affected versions are 5.63 and earlier, and the fix is to update to version 5.64 or later.[1]
The announcement clearly states that an unauthenticated remote attacker can exploit a fixed API KEY to gain control of all installed DMS+ devices.[1]
The danger of Hard-coded Credentials is that the “secret” is no longer secret. When an API key is hard-coded into the system, anyone who obtains the program, packets, configuration files, or related implementation details may reuse the same credentials to send requests to the service.
According to the description in this case, the attacker does not need an account or password, does not need to log in first, and does not need local privileges; as long as the relevant interface is reachable over the network, there is a chance to gain control through the fixed API KEY.[1]
The announcement defines the risk as “gaining control of all installed DMS+ devices,” which means the impact may not be limited to a single device.[1]
The affected product is DMS+ (Non-Mobile) version 5.63 and earlier, which is the only explicitly listed version range in this announcement.[1]
Because the vulnerability can be exploited by an unauthenticated remote attacker, the impact is not limited to internal administrators or already logged-in users; as long as the attack surface is exposed to a reachable network environment, it may become a target.[1]
More importantly, the announcement states that the attacker can gain control of “all installed DMS+ devices,” indicating a centralized blast radius.[1]
The most direct and only clearly stated remediation is to update DMS+ (Non-Mobile) to version 5.64 or later.[1]
Before completing the version upgrade, it is recommended to inventory all deployed DMS+ instances, confirm whether any are still running version 5.63 or earlier, and prioritize externally reachable or higher-privilege environments.[1]
5-Step Remediation Checklist