CVE-2020-27688

HIGH

7.5

Descripcion

RVToolsPasswordEncryption.exe in RVTools 4.0.6 allows users to encrypt passwords to be used in the configuration files. This encryption used a static IV and key, and thus using the Decrypt() method from VISKD.cs from the RVTools.exe executable allows for decrypting the encrypted passwords. The accounts used in the configuration files have access to vSphere instances.

Detalles CVE

Puntuacion CVSS v3.17.5

SeveridadHIGH

Vector CVSSCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Vector de ataqueNETWORK

ComplejidadLOW

Privilegios requeridosNONE

Interaccion usuarioNONE

Publicado11/5/2020

Ultima modificacion11/21/2024

Fuentenvd

Avistamientos honeypot0

Productos afectados

robware:rvtools

Debilidades (CWE)

CWE-522

Referencias

https://github.com/matthiasmaes/CVE-2020-27688(cve@mitre.org)

https://www.robware.net/rvtools/(cve@mitre.org)

https://github.com/matthiasmaes/CVE-2020-27688(af854a3a-2127-422b-91ae-364da2661108)

https://www.robware.net/rvtools/(af854a3a-2127-422b-91ae-364da2661108)

Correlaciones IOC

Sin correlaciones registradas

This product uses data from the NVD API but is not endorsed or certified by the NVD.