High severity · published Feb 24, 2026
CVE-2026-27519
Binardat 10G08-0800GSM Network Switch Hard-coded RC4 Encryption Key
7.5
CVSS
0.2%
EPSS
No
On KEV
Description
Binardat 10G08-0800GSM network switch firmware version V300SP10260209 and prior use RC4 with a hard-coded key embedded in client-side JavaScript. Because the key is static and exposed, an attacker can decrypt protected values and defeat confidentiality protections.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 11% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
1N
10G08-0800GSM Network Switch · Binardat Ltd.
through V300SP10260209 · source: vendor
1F
10g08-0800gsm Firmware · Binardat
through V300SP10260209 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-27519
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-27519
Product
https://www.binardat.com/products/8-port-10-gigabit-sfp-managed-switch,-support-1g-sfp-and-10g-sfp-module,-160gbps-bandwidth,-l3-web-managed,-metal-fanless-fiber-binardat-network-switch
Third Party Advisory
https://www.vulncheck.com/advisories/binardat-10g08-0800gsm-network-switch-hard-coded-rc4-encryption-key
More from 10G08-0800GSM Network Switch
9.8
CVE-2026-27507
Binardat 10G08-0800GSM Network Switch Hard-coded Credentials
9.1
CVE-2026-27515
Binardat 10G08-0800GSM Network Switch Predictable Session Identifiers
8.8
CVE-2026-23678
Binardat 10G08-0800GSM Network Switch Traceroute CLI Command Injection
7.5
CVE-2026-27521
Binardat 10G08-0800GSM Network Switch Missing Login Rate Limiting
7.5
CVE-2026-27520
Binardat 10G08-0800GSM Network Switch Base64-encoded Password Stored in Cookie