DMS+ (Non-Mobile), a device management system developed by Rich Source, contains a Use of Hard-coded Credentials vulnerability tracked as CVE-2026-18452. The vulnerability stems from a fixed API key embedded in the software that cannot be changed by users. Unauthenticated remote attackers can exploit this hard-coded API key to gain full control over all installed DMS+ devices without requiring any credentials. The attack vector is remote and requires no authentication, making it particularly severe. This type of vulnerability is a well-known security anti-pattern that exposes all deployments of the affected software simultaneously. The issue has been reported via TWCERT (Taiwan Computer Emergency Response Team). Organizations using DMS+ (Non-Mobile) should apply vendor patches or mitigations immediately. The vulnerability has been assigned a high criticality rating due to the ease of exploitation and potential for widespread impact across all installations.