BitdefenderCVELIST:CVE-2023-39421CVE-2023-39421 Use of Hard-coded Credentials in RDPWin.dll
7.7 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
7.8 High
AI Score
Confidence
High
0.0005 Low
EPSS
Percentile
18.3%
The RDPWin.dll component as used in the IRM Next Generation booking engine includes a set of hardcoded API keys for third-party services such as Twilio and Vonage. These keys allow unrestricted interaction with these services.
CNA Affected
[
{
"defaultStatus": "unaffected",
"modules": [
"RDPWin.dll"
],
"product": "IRM Next Generation",
"vendor": "Resort Data Processing, Inc.",
"versions": [
{
"status": "affected",
"version": "5.4.1.23"
}
]
}
]Related
7.7 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
7.8 High
AI Score
Confidence
High
0.0005 Low
EPSS
Percentile
18.3%