CVE-2022-25577 Hardcoded credentials in n/a
Attackers with system access can read and modify user data due to a hardcoded password used to encrypt the SQLite database.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-25577?
CVE-2022-25577 is a critical vulnerability in n/a, published on 25 Mar 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
ALF-BanCO v8.2.5 and below was discovered to use a hardcoded password to encrypt the SQLite database containing the user's data. Attackers who are able to gain remote or local access to the system are able to read and modify the data.
Weakness: CWE-798
Which versions are affected by CVE-2022-25577?
It affects 1 product.
Products include Alf-Banco Alf-Banco.
How do I fix CVE-2022-25577?
No fix has been published for CVE-2022-25577 yet. Limit exposure of the affected software until one is available.
Is CVE-2022-25577 being exploited?
There is no known exploitation of CVE-2022-25577 in the wild and no public exploit code.
Sources
Also known as GHSA-qvg3-jj6j-c973.