CVE-2026-25803

critical · 9.8

3DP-MANAGER is an inbound generator for 3x-ui. In version 2.0.1 and prior, the application automatically creates an administrative account with known default credentials (admin/admin) upon the first initialization. Attackers with network access to the application's login interface can gain full administrative control, managing VPN tunnels and system settings. This issue will be patched in version 2.0.2.

9.8

CVSS

0.4%

EPSS (exploit prob.)

31st

EPSS percentile

2026-02-06

Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-798

Affected products

Vendor	Product	Affected versions
denpiligrim	3dp-manager	<= 2.0.1

Check a specific version with /api/v1/cve/match.

References

https://github.com/denpiligrim/3dp-manager/commit/f568de41de97dd1b70a963708a1ee18e52b9d248
https://github.com/denpiligrim/3dp-manager/security/advisories/GHSA-5x57-h7cw-9jmw

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2026-25803