Verax NMS Hardcoded Private Key

`Verax NMS Hardcoded Private Key (CVE-2013-1352)  
  
I. BACKGROUND  
----------------------  
Verax NMS provides a service-oriented, unified  
management & monitoring of networks, applications  
and infrastructure enabling quick problem detection,  
root-cause analysis, reporting and automating recovery,  
reducing costs and shortening downtimes of IT service delivery.  
  
Source: http://www.veraxsystems.com/en/products/nms  
  
II. DESCRIPTION  
----------------------  
In versions prior to 2.1.0 of VeraxNMS, the server-side component  
eadministratorconsole-core-1.5.2.jar, contains a method named  
decryptPassword(). This method provides the functionality  
to decrypt a user's password using an implementation of RSA.  
Within com.veraxsystems.eadministratorconsole.remote.service.impl,  
it has been discovered that decryptPassword() uses a static,  
hardcoded private key to facilitate this process. As a result,  
these passwords should be considered insecure due to the fact  
that recovering the private key is decidedly trivial.  
  
III. AFFECTED PRODUCTS  
----------------------  
All versions of Verax NMS prior to 2.1.0 are vulnerable.  
  
IV. RECOMMENDATION  
----------------------  
Users should upgrade to version 2.1.0 of Verax NMS.  
  
V. CREDIT  
----------------------  
This vulnerability was discovered by Andrew Brooks.  
  
VI. REFERENCES  
----------------------  
CVE-2013-1352  
CVE-2013-1351 (Related)  
http://download.veraxsystems.com/download/nms-2.1.0-release-notes.txt  
  
VII. TIMELINE  
----------------------  
1/10/2013 - Vendor notified  
1/11/2013 - Vendor acknowledges bug report  
2/20/2013 - Vulnerability remediated and pushed to mainline  
`