CVE-2024-45165

An issue was discovered in UCI IDOL 2 (aka uciIDOL or IDOL2) through 2.12

Medium · published August 22, 2024

CVSS v3.1
5.3
EPSS
0%
Percentile
6.5
In the wild
Unconfirmed
What it is

An issue was discovered in UCI IDOL 2 (aka uciIDOL or IDOL2) through 2.12. Data is sent between client and server with encryption. However, the key is derived from the string "(c)2007 UCI Software GmbH B.Boll" (without quotes). The key is both static and hardcoded. With access to messages, this results in message decryption and encryption by an attacker. Thus, it enables passive and active man-in-the-middle attacks.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00174 · 6.5th percentile
Published
2024-08-22T00:00Z
EPSS history
Timeline
  • 22 AUG 00:00Z
    An issue was discovered in UCI IDOL 2 (aka uciIDOL or IDOL2) through 2.12
    cvelistv5