CVE-2026-54554

7.5High

Published 14 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash

7.5High

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None
Impact: High impact on confidentiality
Weakness: CWE-200

Impact

Remote unauthenticated attackers can obtain the default Active Directory domain-join password. They only need network access to the FOG web server.

Root cause

The adInfo() management endpoint exposes the configured FOG_AD_DEFAULT_PASSWORD in JSON responses and can be dispatched without an active session via the node=ipxe parameter.

Affected systems

FOG Project versions prior to 1.5.10.1870

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Fix & remediation

Upgrade FOG Project to version 1.5.10.1870 or newer. If you cannot patch immediately, restrict network access to the FOG management interface or rotate and remove the default AD password from FOG configuration.

shell

$ git pull && git checkout 1.5.10.1870 && cd bin && ./installfog.sh -y

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to 1.5.10.1870, the management adInfo() endpoint in packages/web/lib/fog/fogpage.class.php was reported to return the FOG_AD_DEFAULT_PASSWORD value in its domainpass JSON field and to be dispatchable through node=ipxe without an authenticated session. The response was also consumed by host and group Active Directory configuration interfaces. This could disclose the default domain-join credential to a remote unauthenticated requester. This vulnerability is fixed in 1.5.10.1870.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-54554