CVE-2026-11347CWE-321CWE-338

Hardcoded Cryptographic Keys and Weak IV Generation in linqi

High · published June 5, 2026

CVSS v4.0
8.5
EPSS
0%
Percentile
0.1
In the wild
Unconfirmed
What it is

The linqi application contains hardcoded cryptographic keys. Additionally, the application uses a weak algorithm with a limited ASCII charset to dynamically generate Initialization Vectors (IVs) for AES/CBC encryption, making known-plaintext attacks feasible. An attacker with local access can leverage these vulnerabilities to decrypt sensitive obfuscated strings, including ConnectionString values containing database credentials from appsettings.json.

The record
Technical detail
CVSS v4.0
8.5 · HIGH
Vector
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00073 · 0.1th percentile
Weaknesses
CWE-321 · Use of Hard-coded Cryptographic Key; CWE-338 · Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
Published
2026-06-05T10:18Z
EPSS history
Timeline
  • 05 JUN 10:18Z
    Hardcoded Cryptographic Keys and Weak IV Generation in linqi
    cvelistv5