CVE-2024-36496
Severity CVSS v4.0:
Pending analysis
Type:
CWE-798
Use of Hard-coded Credentials
Publication date:
24/06/2024
Last modified:
03/07/2024
Description
The configuration file is encrypted with a static key derived from a <br />
static five-character password which allows an attacker to decrypt this <br />
file. The application hashes this five-character password with <br />
the outdated and broken MD5 algorithm (no salt) and uses the first five <br />
bytes as the key for RC4. The configuration file is then encrypted with <br />
these parameters.
Impact
Base Score 3.x
7.50
Severity 3.x
HIGH