CVE-2024-53356 Hardcoded credentials in n/a
Hardcoded JWT secret allows remote attackers to forge tokens and escalate privileges in EasyVirt DCScope and CO2Scope applications.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-53356?
CVE-2024-53356 is a critical vulnerability in n/a, published on 31 Jan 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Weak JWT Secret vulnerabilitiy in EasyVirt DCScope <= 8.6.0 and CO2Scope <= 1.3.0 allows remote attackers to generate JWT for privilege escalation. The HMAC secret used for generating tokens is hardcoded as "somerandomaccesstoken". A weak HMAC secret poses a risk because attackers can use the predictable secret to create valid JSON Web Tokens (JWTs), allowing them access to important information and actions within the application.
Weakness: CWE-798
Which versions are affected by CVE-2024-53356?
It affects 2 products.
Products include Easyvirt Co2scope, Easyvirt Dcscope.
How do I fix CVE-2024-53356?
No fix has been published for CVE-2024-53356 yet. Limit exposure of the affected software until one is available.
Is CVE-2024-53356 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-53356 exists.
Other vulnerabilities in n/a
Sources
Also known as GHSA-5pcx-4fpr-p436.