CVE-2023-49256 Predictable encryption passphrase used in publicly accessible configuration file

It is possible to download the configuration backup without authorization and decrypt included passwords using hardcoded static key...

CVE-2023-49256

CVE-2023-49256 allows unauthenticated retrieval of a device’s configuration backup and decryption of passwords, using a hardcoded static key. Red Hat’s linked entries reiterate the issue and describe the root cause as hardcoded credentials embedded in the device, enabling confidentiality impact (...