Hard-Coded API Key Enables Unauthenticated DMS+ Device Control

DMS+ (Non-Mobile) developed by Rich Source has a Use of Hard-coded Credentials vulnerability. Unauthenticated remote attackers can exploit a fixed API key to gain control over all installed DMS+ devices.

Casky was already ahead

This CVE exploits attack patterns that Casky's 233matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

DMS+ devices from Rich Source contain embedded API credentials that cannot be changed or revoked, allowing any attacker with network access to authenticate as a legitimate system user. This vulnerability (CWE-798: Use of Hard-coded Credentials) is critical because it eliminates authentication as a security boundary—attackers need no credentials of their own, only knowledge of the fixed key. Organizations deploying DMS+ across multiple sites face enterprise-wide compromise risk, as a single discovered key grants unauthorized control over all instances simultaneously. The attack requires no user interaction, zero-day exploitation, or privilege escalation; remote attackers can immediately move from network access to full device control.

Casky's 233 mapped skills detect this attack through MITRE ATT&CK Technique TA0006 (Credential Access) behavioral patterns. Claude's extended reasoning identifies telltale signs: repeated API calls using identical authentication tokens from unexpected sources, failed authentication attempts followed by success using hardcoded patterns, and lateral movement across multiple DMS+ instances using the same credentials. Practitioners using Casky would see findings highlighting suspicious API key usage patterns, unauthenticated remote connections establishing device management sessions, and batch operations across distributed DMS+ infrastructure—all indicators that an attacker has discovered and weaponized the embedded credentials. The AI-driven analysis connects these discrete events into a coherent attack narrative, enabling security teams to identify compromise before operational damage occurs.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

233 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-18452.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

cryptography · low

Run

MITRE ATT&CK Techniques

TA0006

Investigate the attack patterns behind CVE-2026-18452

Casky has 233 skills that investigate the attack patterns behind CVE-2026-18452. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn