CVE-2018-8902 Hardcoded credentials in n/a
Attackers with database access can use a shared hardcoded key to decrypt confidential data, including Wi-Fi passwords, across all product instances.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2018-8902?
CVE-2018-8902 is a medium-severity vulnerability in Ivanti Avalanche, published on 29 Jun 2018. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
An issue was discovered in Ivanti Avalanche for all versions between 5.3 and 6.2. The impacted products used a single shared key encryption model to encrypt data. A user with access to system databases can use the discovered key to access potentially confidential stored data, which may include Wi-Fi passwords. This discovered key can be used for all instances of the product.
Weakness: CWE-287
Which versions are affected by CVE-2018-8902?
It affects 1 product.
Products include Ivanti Avalanche.
How do I fix CVE-2018-8902?
No fix has been published for CVE-2018-8902 yet. Limit exposure of the affected software until one is available.
Is CVE-2018-8902 being exploited?
There is no known exploitation of CVE-2018-8902 in the wild and no public exploit code.
Other vulnerabilities in Ivanti Avalanche
Sources
Also known as GHSA-fwc5-p88w-fh8w.