CVE-2024-36496

Hardcoded Credentials

State: Published
Severity: 7.5 High
Published: Jun 24, 2024
Updated: Feb 13, 2025
Reserved: May 29, 2024

Description

The configuration file is encrypted with a static key derived from a static five-character password which allows an attacker to decrypt this file. The application hashes this five-character password with the outdated and broken MD5 algorithm (no salt) and uses the first five bytes as the key for RC4. The configuration file is then encrypted with these parameters.

Scores

CVSS	Score	Vector	Source
3.1	7.5 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N	CISA-ADP

Weaknesses

CWE-798 Use of Hard-coded Credentials

Affected Products

Product	Versions
WINSelect (Standard + Enterprise)Faronics	8.30.xx.903Not affected

References

https://r.sec-consult.com/winselectthird-party-advisoryexploit
https://www.faronics.com/en-uk/document-library/document/winselect-standard-release-notesrelease-notes
http://seclists.org/fulldisclosure/2024/Jun/12

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.