VIN-DS783E-E6 developed by Vacron has a Hidden Functionality vulnerability, allowing unauthenticated remote attackers to exploit a specific hidden function to o…

A Hidden Functionality vulnerability (CVE-2026-18191) has been identified in the Vacron VIN-DS783E-E6 network device. The flaw allows unauthenticated remote attackers to exploit a concealed function within the device to retrieve administrator credentials. No authentication is required to leverage this vulnerability, making it highly accessible to remote threat actors. Successful exploitation grants full administrative access to the affected device. The vulnerability was reported via TWCERT and published on NVD. Vacron is the manufacturer of the affected device. The severity is rated High due to the ease of exploitation and impact on credential confidentiality. Organizations using this device should apply patches or mitigations as soon as they become available.