CVE-2026-25803

3DP-MANAGER Uses Hard-coded Credentials

CVSS 9.8 CRITICALEPSS 0.4%CWE-798

Vexday Risk Score

28Low

SSVC decision (CISA)

Track

No exploitation signal → monitor

CVSS 9.8EPSS 0.4%KEV nãoPoC —Nuclei —Metasploit —Patch —

Lifecycle

06 Feb 2026Published on NVD

Recommendation: Monitor — no exploitation signal at the moment.

3DP-MANAGER is an inbound generator for 3x-ui. In version 2.0.1 and prior, the application automatically creates an administrative account with known default credentials (admin/admin) upon the first initialization. Attackers with network access to the application's login interface can gain full administrative control, managing VPN tunnels and system settings. This issue will be patched in version 2.0.2.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

denpiligrim · 3dp-manager

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://github.com/denpiligrim/3dp-manager/commit/f568de41de97dd1b70a963708a1ee18e52b9d248 https://github.com/denpiligrim/3dp-manager/security/advisories/GHSA-5x57-h7cw-9jmw