# CVE-2026-18452: Rich Source DMS+ hard-coded API key

Source: https://junglewise.ai/threats/cve-2026-18452-rich-source-dms-hard-coded-api-key  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-31. Updated: 2026-07-31  
License: CC BY 4.0 with a link back

CVE-2026-18452 · Severity: critical · CVSS 10 · Published 2026-07-31

Rich Source DMS+ (Non-Mobile), a device management system, contains a critical security flaw where a fixed, universal API key is used for authentication. An unauthorized person can use this hard-coded key to remotely take full control of any installed DMS+ device. This could lead to complete service disruption, unauthorized access to managed systems, and potential data breaches across all affected hardware.

## Quick answers

**Is CVE-2026-18452 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-18452 being exploited in the wild.

**How severe is CVE-2026-18452?** Critical severity, with a CVSS score of 10, published 31 July 2026.

**Which products and versions are affected?** Rich Source DMS+ (Non-Mobile) 5.63 and earlier.

**Is there a fix for CVE-2026-18452?** A patch was published on 2026-07-31: Version 5.64 released to address the vulnerability Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-18452 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-18452?** Check whether you run Rich Source DMS+ (Non-Mobile) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability (CWE-798) exists in Rich Source DMS+ (Non-Mobile) versions 5.63 and earlier due to the use of a fixed, hard-coded API key. This allows an unauthenticated remote attacker to bypass standard authentication mechanisms by providing the static key in API requests. Successful exploitation grants the attacker full administrative control over the affected DMS+ devices. The issue is resolved in version 5.64 and later.

## Affected products

- Rich Source DMS+ (Non-Mobile) 5.63 and earlier

## Timeline

- 2026-07-31: advisory: Advisory published by TWCERT/CC
- 2026-07-31: patched: Version 5.64 released to address the vulnerability

## References

- [https://www.twcert.org.tw/en/cp-139-11073-de184-2.html](https://www.twcert.org.tw/en/cp-139-11073-de184-2.html)
- [https://www.twcert.org.tw/tw/cp-132-11072-3a4d4-1.html](https://www.twcert.org.tw/tw/cp-132-11072-3a4d4-1.html)