CVE-2024-36496 Hardcoded Credentials
Attackers can decrypt configuration files using a static key derived from a hardcoded password, exposing sensitive data and bypassing security controls.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-36496?
CVE-2024-36496 is a high-severity vulnerability in Faronics WINSelect (Standard + Enterprise), published on 24 Jun 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The configuration file is encrypted with a static key derived from a static five-character password which allows an attacker to decrypt this file. The application hashes this five-character password with the outdated and broken MD5 algorithm (no salt) and uses the first five bytes as the key for RC4. The configuration file is then encrypted with these parameters.
Weakness: CWE-798
Which versions are affected by CVE-2024-36496?
How do I fix CVE-2024-36496?
No fix has been published for CVE-2024-36496 yet. Limit exposure of the affected software until one is available.
Is CVE-2024-36496 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-36496 exists.
Sources
Also known as GHSA-jm6p-8vc7-99q9.