CVE-2023-27169CWE-798hardcoded-credentials

CVE-2023-27169

Medium · published September 12, 2023

CVSS v3.1
6.5
EPSS
0%
Percentile
23.7
In the wild
Unconfirmed
What it is

Xpand IT Write-back manager v2.3.1 uses a hardcoded salt in license class configuration which leads to the generation of a hardcoded and predictable symmetric encryption keys for license generation and validation.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00320 · 23.7th percentile
Weakness
CWE-798 · Use of Hard-coded Credentials
Published
2023-09-12T16:15Z
Affected products (1)
ProductVersionsFixed in
xpand-it/write-back_managerall versions—
References (9)
https://balwurk.com · [email protected]https://balwurk.com/cve-use-of-hard-coded-cryptographic-key/ · [email protected]https://ghostline.neocities.org/CVE-2023-27169/ · [email protected]https://writeback4t.com · [email protected]https://www.xpand-it.com · [email protected]https://balwurk.com · af854a3a-2127-422b-91ae-364da2661108https://balwurk.com/cve-use-of-hard-coded-cryptographic-key/ · af854a3a-2127-422b-91ae-364da2661108https://writeback4t.com · af854a3a-2127-422b-91ae-364da2661108https://www.xpand-it.com · af854a3a-2127-422b-91ae-364da2661108
EPSS history
Timeline
  • 12 SEP 00:00Z
    Xpand IT Write-back manager v2.3.1 uses a hardcoded salt in license class configuration which leads to the generation of a hardcoded and predictable symmetric…
    cvelistv5