CVE-2020-14474 Hardcoded credentials in n/a
Hardcoded key material in Cellebrite UFED allows attackers to decrypt protected data on devices running affected software versions.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-14474?
CVE-2020-14474 is a high-severity vulnerability in n/a, published on 30 Jun 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Cellebrite UFED physical device 5.0 through 7.5.0.845 relies on key material hardcoded within both the executable code supporting the decryption process, and within the encrypted files themselves by using a key enveloping technique. The recovered key material is the same for every device running the same version of the software, and does not appear to be changed with each new build. It is possible to reconstruct the decryption process using the hardcoded key material and obtain easy access to otherwise protected data.
Weakness: CWE-798
Which versions are affected by CVE-2020-14474?
It affects 1 product.
Products include Cellebrite Ufed Firmware.
How do I fix CVE-2020-14474?
No fix has been published for CVE-2020-14474 yet. Limit exposure of the affected software until one is available.
Is CVE-2020-14474 being exploited?
There is no known exploitation of CVE-2020-14474 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-x3pm-5wjh-h6w2.