CVE-2020-10601 Weak cryptography in VBASE Editor
A local attacker can bypass password protection in VISAM VBASE Editor and Web-Remote Module by exploiting weak hashing algorithms and insecure permissions.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-10601?
CVE-2020-10601 is a high-severity vulnerability in VISAM VBASE Editor, published on 3 Apr 2020. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
VISAM VBASE Editor version 11.5.0.2 and VBASE Web-Remote Module allow weak hashing algorithm and insecure permissions which may allow a local attacker to bypass the password-protected mechanism through brute-force attacks, cracking techniques, or overwriting the password hash.
Which versions are affected by CVE-2020-10601?
It affects 2 products.
Products include Visam Vbase Editor, Visam Vbase Web-Remote.
How do I fix CVE-2020-10601?
No fix has been published for CVE-2020-10601 yet. Limit exposure of the affected software until one is available.
Is CVE-2020-10601 being exploited?
There is no known exploitation of CVE-2020-10601 in the wild and no public exploit code.
Other vulnerabilities in VISAM VBASE Editor
Sources
Also known as GHSA-874w-47f4-39q6.