2 lines
3.1 KiB
JSON
2 lines
3.1 KiB
JSON
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","modules":["connectwise-password-encryption-utlity.exe"],"product":"Risk Assessment","vendor":"ConnectWise","versions":[{"status":"affected","version":"All versions prior to deprecation (July 2023)"}]}],"source":"7d616e1a-3288-43b1-a0dd-0a65d3e70a49"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:connectwise:risk_assessment:*:*:*:*:*:*:*:*","matchCriteriaId":"F16CBD69-2DC0-4D6E-8A30-A7A27700F61B","versionEndExcluding":"2023-07-01","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"ConnectWise-Password-Encryption-Utility.exe in ConnectWise Risk Assessment allows an attacker to extract a hardcoded AES decryption key via reverse engineering. This key is embedded in plaintext within the binary and used in cryptographic operations without dynamic key management. Once obtained the key can be used to decrypt CSV input files used for authenticated network scanning."},{"lang":"es","value":"ConnectWise-Password-Encryption-Utility.exe, en la Evaluación de Riesgos de ConnectWise, permite a un atacante extraer una clave de descifrado AES codificada mediante ingeniería inversa. Esta clave se incrusta en texto plano dentro del binario y se utiliza en operaciones criptográficas sin gestión dinámica de claves. Una vez obtenida, la clave puede utilizarse para descifrar archivos CSV de entrada utilizados para el escaneo de red autenticado."}],"id":"CVE-2025-4876","lastModified":"2026-06-17T09:34:12.560","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":6.0,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"HIGH","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":1.5,"impactScore":4.0,"source":"7d616e1a-3288-43b1-a0dd-0a65d3e70a49","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":4.4,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":0.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2025-4876","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2025-05-19T16:48:28.836537Z","version":"2.0.3"}}]},"published":"2025-05-19T16:15:35.107","references":[{"source":"7d616e1a-3288-43b1-a0dd-0a65d3e70a49","tags":["Third Party Advisory"],"url":"https://github.com/packetlabs/vulnerability-advisory/blob/main/Disclosures/PL-2025-11315/README.md"}],"sourceIdentifier":"7d616e1a-3288-43b1-a0dd-0a65d3e70a49","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-321"}],"source":"7d616e1a-3288-43b1-a0dd-0a65d3e70a49","type":"Secondary"}]}
|