Multiple Fortinet Products CVE-2018-9195 Hardcoded Cryptographic Key Vulnerability

Description Multiple Fortinet products are prone to a hard-coded cryptographic key vulnerability. An attacker can exploit this issue to perform man-in-the-middle attacks and obtain sensitive information. Successful exploits will lead to other attacks. The following Fortinet products are affected:...

PT-2019-5737 · Fortinet · Fortimanager +1

Name of the Vulnerable Software and Affected Versions: FortiManager versions 6.2.3 and below FortiAnalyzer versions 6.2.3 and below Description: The issue is related to the use of a hard-coded cryptographic key in the CLI configuration of FortiManager and FortiAnalyzer, which may allow an attacke...

Fortinet FortiOS CVE-2019-6693 Hardcoded Cryptographic Key Vulnerability

Description Fortinet FortiOS is prone to a hardcoded cryptographic key vulnerability. Successful exploits will allow attackers to obtain sensitive information that may aid in further attacks. Versions prior to Fortinet FortiOS 5.6.11, 6.0.7 and 6.2.1 are vulnerable. Technologies Affected Fortinet...

CVE-2019-15802

An issue was discovered on Zyxel GS1900 devices with firmware before 2.50AAHH.0C0. The firmware hashes and encrypts passwords using a hardcoded cryptographic key in salutilstrencrypt in libsal.so.0.0. The parameters salt, IV, and key data are used to encrypt and decrypt all passwords using AES256...

Hardcoded credentials

An issue was discovered on Zyxel GS1900 devices with firmware before 2.50AAHH.0C0. The firmware hashes and encrypts passwords using a hardcoded cryptographic key in salutilstrencrypt in libsal.so.0.0. The parameters salt, IV, and key data are used to encrypt and decrypt all passwords using AES256...

CVE-2019-15801

An issue was discovered on Zyxel GS1900 devices with firmware before 2.50AAHH.0C0. The firmware image contains encrypted passwords that are used to authenticate users wishing to access a diagnostics or password-recovery menu. Using the hardcoded cryptographic key found elsewhere in the firmware,...

CVE-2019-15802

An issue was discovered on Zyxel GS1900 devices with firmware before 2.50AAHH.0C0. The firmware hashes and encrypts passwords using a hardcoded cryptographic key in salutilstrencrypt in libsal.so.0.0. The parameters salt, IV, and key data are used to encrypt and decrypt all passwords using AES256...

CVE-2019-15802

Affected product: Zyxel GS1900 switches. Vulnerability: firmware before 2.50(AAHH.0)C0 uses a hardcoded cryptographic key in libsal.so.0.0 to encrypt passwords via AES-256 CBC; the salt, IV, and key data are used to encrypt/decrypt all passwords, including those in config backups embedded in the ...

Siemens SIMATIC IT UADM CVE-2019-13929 Hardcoded Cryptographic Key Vulnerability

Description Siemens SIMATIC IT UADM is prone to a hard-coded cryptographic key vulnerability. An attacker can exploit this issue to gain unauthorized access to the vulnerable device and perform unauthorized actions. Versions prior to SIMATIC IT UADM 1.3 are vulnerable. Technologies Affected Sieme...

CVE-2019-10963: Use of Hard-coded Cryptographic Key

Moxa EDR 810, all versions 5.1 and prior, allows an unauthenticated attacker to be able to retrieve some log files from the device, which may allow sensitive information disclosure. Log files must have previously been exported by a legitimate user...

ICSA-19-281-04 Siemens SIMATIC IT UADM

1. EXECUTIVE SUMMARY CVSS v3 6.8 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: Siemens Equipment: SIMATIC IT Unified Architecture Discrete Manufacturing UADM Vulnerability: Use of Hard-coded Cryptographic Key 2. RISK EVALUATION Successful exploitation of this vulnerability...

The vulnerability of the microprogrammed Ethernet switch software from Moxa, models PT-7528 and PT-7828, stems from the use of a rigidly encrypted cryptographic key for encrypting account data. This allows attackers to enhance their privileges.

The vulnerability of the microprogrammed Ethernet switch software of Moxa PT-7528 and Moxa PT-7828 lies in the use of a rigidly encrypted cryptographic key, which is used for encrypting account data. Exploiting this vulnerability allows a remote attacker to enhance their privileges...

PT-2019-5399

Name of the Vulnerable Software and Affected Versions Easergy Builder versions 1.4.7.2 and prior Description A vulnerability exists due to the use of a hard-coded cryptographic key stored in cleartext, which could allow an attacker to decrypt passwords. This issue is related to the storage of the...

CVE-2019-7594: Use of Hard-coded Cryptographic Key

Metasys® ADS/ADX servers and NAE/NIE/NCE engines prior to 9.0 make use of a hardcoded RC2 key for certain encryption operations involving the Site Management Portal SMP...

Johnson Controls Metasys

1. EXECUTIVE SUMMARY CVSS v3 6.8 ATTENTION: Exploitable remotely Vendor: Johnson Controls Equipment: Metasys Vulnerabilities: Reusing a Nonce, Key Pair in Encryption; Use of Hard-coded Cryptographic Key 2. RISK EVALUATION Successful exploitation of these vulnerabilities could be leveraged by an...

WolfVision Cynap 1.18g / 1.28j Hardcoded Credential

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Advisory ID: SYSS-2019-021 Product: Cynap Manufacturer: WolfVision Affected Versions: 1.18g, 1.28j Tested Versions: 1.18g, 1.28j Vulnerability Type: Use of Hard-coded Cryptographic Key CWE-321 Risk Level: High Solution Status: Fixed Manufacturer...

WAGO Industrial Managed Switches 852-303, 852-1305, and 852-1505

1. EXECUTIVE SUMMARY CVSS v3 9.8 ATTENTION : Exploitable remotely/low skill level to exploit Vendor : WAGO Equipment : Industrial Managed Switches 852-303, 852-1305, and 852-1505 Vulnerabilities : Use of Hard-coded Credentials, Use of Hard-coded Cryptographic Key, Using Components with Known...

Siemens LOGO! 8 Hard-Coded Cryptographic Key

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Advisory ID: SYSS-2019-012 Product: LOGO! Manufacturer: Siemens Affected Versions: LOGO! 8 all versions Tested Versions: LOGO! 8, 6ED1052-2MD00-0BA8 FS:03, 0BA8.Standard V1.08.03 Vulnerability Type: Use of Hard-coded Cryptographic Key CWE-321 Risk...

Siemens LOGO! 8 Hard-Coded Cryptographic Key Vulnerability

Due to the use of a hard-coded cryptographic key, an attacker can put the integrity and confidentiality of encrypted data of all Siemens LOGO! 8 PLCs using this key at risk, for instance decrypting network communication during a man-in-the-middle attack. Siemens LOGO! 8 Hard-Coded Cryptographic K...

Computrols CBAS Web

1. EXECUTIVE SUMMARY CVSS v3 8.8 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: Computrols Equipment: CBAS Web Vulnerabilities: Cross-site Request Forgery, Information Exposure Through Discrepancy, Cross-site Scripting, Command Injection, Information Exposure Through Source...