CWE-321 Archives - CVE Vulnerability https://cvevulnerability.com/cwe_categories/cwe-321/ Sun, 26 Feb 2023 06:45:02 +0000 en-US hourly 1 https://wordpress.org/?v=7.0 https://cvevulnerability.com/wp-content/uploads/2023/02/cropped-Screenshot-2023-02-27-at-3.52.32-PM-32x32.png CWE-321 Archives - CVE Vulnerability https://cvevulnerability.com/cwe_categories/cwe-321/ 32 32 CVE-2018-10896 https://cvevulnerability.com/cve_vulnerabilities/cve-2018-10896/ Sun, 26 Feb 2023 06:45:02 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2018-10896/ The default cloud-init configuration, in cloud-init 0.6.2 and newer, included “ssh_deletekeys: 0”, disabling cloud-init’s deletion of ssh host keys. In some environments, this could lead to instances created by cloning a golden master or template system, sharing ssh host keys, and being able to impersonate one another or conduct man-in-the-middle attacks.

The post CVE-2018-10896 appeared first on CVE Vulnerability.

]]> The default cloud-init configuration, in cloud-init 0.6.2 and newer, included “ssh_deletekeys: 0”, disabling cloud-init’s deletion of ssh host keys. In some environments, this could lead to instances created by cloning a golden master or template system, sharing ssh host keys, and being able to impersonate one another or conduct man-in-the-middle attacks.

The post CVE-2018-10896 appeared first on CVE Vulnerability.

]]> CVE-2020-28391 https://cvevulnerability.com/cve_vulnerabilities/cve-2020-28391/ Sun, 26 Feb 2023 06:40:39 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2020-28391/ A vulnerability has been identified in SCALANCE X-200 switch family (incl. SIPLUS NET variants) (All versions < V5.2.5), SCALANCE X-200IRT switch family (incl. SIPLUS NET variants) (All versions < V5.5.0), SCALANCE X-200RNA switch family (All versions < V3.2.7). Devices create a new unique key upon factory reset, except when used with C-PLUG. When used with […]

The post CVE-2020-28391 appeared first on CVE Vulnerability.

]]> A vulnerability has been identified in SCALANCE X-200 switch family (incl. SIPLUS NET variants) (All versions < V5.2.5), SCALANCE X-200IRT switch family (incl. SIPLUS NET variants) (All versions < V5.5.0), SCALANCE X-200RNA switch family (All versions < V3.2.7). Devices create a new unique key upon factory reset, except when used with C-PLUG. When used with C-PLUG the devices use the hardcoded private RSA-key shipped with the firmware-image. An attacker could leverage this situation to a man-in-the-middle situation and decrypt previously captured traffic.

The post CVE-2020-28391 appeared first on CVE Vulnerability.

]]> CVE-2020-28395 https://cvevulnerability.com/cve_vulnerabilities/cve-2020-28395/ Sun, 26 Feb 2023 06:40:39 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2020-28395/ A vulnerability has been identified in SCALANCE X-200RNA switch family (All versions < V3.2.7), SCALANCE X-300 switch family (incl. X408 and SIPLUS NET variants) (All versions < V4.1.0). Devices do not create a new unique private key after factory reset. An attacker could leverage this situation to a man-in-the-middle situation and decrypt previously captured traffic.

The post CVE-2020-28395 appeared first on CVE Vulnerability.

]]> A vulnerability has been identified in SCALANCE X-200RNA switch family (All versions < V3.2.7), SCALANCE X-300 switch family (incl. X408 and SIPLUS NET variants) (All versions < V4.1.0). Devices do not create a new unique private key after factory reset. An attacker could leverage this situation to a man-in-the-middle situation and decrypt previously captured traffic.

The post CVE-2020-28395 appeared first on CVE Vulnerability.

]]> CVE-2020-25231 https://cvevulnerability.com/cve_vulnerabilities/cve-2020-25231/ Sun, 26 Feb 2023 06:39:40 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2020-25231/ A vulnerability has been identified in LOGO! 8 BM (incl. SIPLUS variants) (All versions < V8.3), LOGO! Soft Comfort (All versions < V8.3). The encryption of program data for the affected devices uses a static key. An attacker could use this key to extract confidential information from protected program files.

The post CVE-2020-25231 appeared first on CVE Vulnerability.

]]> A vulnerability has been identified in LOGO! 8 BM (incl. SIPLUS variants) (All versions < V8.3), LOGO! Soft Comfort (All versions < V8.3). The encryption of program data for the affected devices uses a static key. An attacker could use this key to extract confidential information from protected program files.

The post CVE-2020-25231 appeared first on CVE Vulnerability.

]]> CVE-2020-25233 https://cvevulnerability.com/cve_vulnerabilities/cve-2020-25233/ Sun, 26 Feb 2023 06:39:40 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2020-25233/ A vulnerability has been identified in LOGO! 8 BM (incl. SIPLUS variants) (All versions < V8.3). The firmware update of affected devices contains the private RSA key that is used as a basis for encryption of communication with the device.

The post CVE-2020-25233 appeared first on CVE Vulnerability.

]]> A vulnerability has been identified in LOGO! 8 BM (incl. SIPLUS variants) (All versions < V8.3). The firmware update of affected devices contains the private RSA key that is used as a basis for encryption of communication with the device.

The post CVE-2020-25233 appeared first on CVE Vulnerability.

]]> CVE-2020-25234 https://cvevulnerability.com/cve_vulnerabilities/cve-2020-25234/ Sun, 26 Feb 2023 06:39:40 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2020-25234/ A vulnerability has been identified in LOGO! 8 BM (incl. SIPLUS variants) (All versions < V8.3), LOGO! Soft Comfort (All versions < V8.3). The LOGO! program files generated and used by the affected components offer the possibility to save user-defined functions (UDF) in a password protected way. This protection is implemented in the software that […]

The post CVE-2020-25234 appeared first on CVE Vulnerability.

]]> A vulnerability has been identified in LOGO! 8 BM (incl. SIPLUS variants) (All versions < V8.3), LOGO! Soft Comfort (All versions < V8.3). The LOGO! program files generated and used by the affected components offer the possibility to save user-defined functions (UDF) in a password protected way. This protection is implemented in the software that displays the information. An attacker could reverse engineer the UDFs directly from stored program files.

The post CVE-2020-25234 appeared first on CVE Vulnerability.

]]> CVE-2020-10884 https://cvevulnerability.com/cve_vulnerabilities/cve-2020-10884/ Sun, 26 Feb 2023 06:36:00 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2020-10884/ This vulnerability allows network-adjacent attackers execute arbitrary code on affected installations of TP-Link Archer A7 Firmware Ver: 190726 AC1750 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the tdpServer service, which listens on UDP port 20002 by default. This issue results from the use of hard-coded encryption key. An […]

The post CVE-2020-10884 appeared first on CVE Vulnerability.

]]> This vulnerability allows network-adjacent attackers execute arbitrary code on affected installations of TP-Link Archer A7 Firmware Ver: 190726 AC1750 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the tdpServer service, which listens on UDP port 20002 by default. This issue results from the use of hard-coded encryption key. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of root. Was ZDI-CAN-9652.

The post CVE-2020-10884 appeared first on CVE Vulnerability.

]]> CVE-2019-10920 https://cvevulnerability.com/cve_vulnerabilities/cve-2019-10920/ Sun, 26 Feb 2023 06:29:21 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2019-10920/ A vulnerability has been identified in LOGO! 8 BM (incl. SIPLUS variants) (All versions < V8.3). Project data stored on the device, which is accessible via port 10005/tcp, can be decrypted due to a hardcoded encryption key. The security vulnerability could be exploited by an unauthenticated attacker with network access to port 10005/tcp. No user […]

The post CVE-2019-10920 appeared first on CVE Vulnerability.

]]> A vulnerability has been identified in LOGO! 8 BM (incl. SIPLUS variants) (All versions < V8.3). Project data stored on the device, which is accessible via port 10005/tcp, can be decrypted due to a hardcoded encryption key. The security vulnerability could be exploited by an unauthenticated attacker with network access to port 10005/tcp. No user interaction is required to exploit this security vulnerability. The vulnerability impacts confidentiality of the device. At the time of advisory publication no public exploitation of this security vulnerability was known.

The post CVE-2019-10920 appeared first on CVE Vulnerability.

]]> CVE-2021-43587 https://cvevulnerability.com/cve_vulnerabilities/cve-2021-43587/ Thu, 23 Feb 2023 14:12:30 +0000 http://www.cvevulnerability.com/cve_vulnerabilities/cve-2021-43587/ Dell PowerPath Management Appliance, versions 3.2, 3.1, 3.0 P01, 3.0, and 2.6, use hard-coded cryptographic key. A local high-privileged malicious user may potentially exploit this vulnerability to gain access to secrets and elevate to gain higher privileges.

The post CVE-2021-43587 appeared first on CVE Vulnerability.

]]> Dell PowerPath Management Appliance, versions 3.2, 3.1, 3.0 P01, 3.0, and 2.6, use hard-coded cryptographic key. A local high-privileged malicious user may potentially exploit this vulnerability to gain access to secrets and elevate to gain higher privileges.

The post CVE-2021-43587 appeared first on CVE Vulnerability.

]]> CVE-2021-43552 https://cvevulnerability.com/cve_vulnerabilities/cve-2021-43552/ Thu, 23 Feb 2023 14:12:29 +0000 http://www.cvevulnerability.com/cve_vulnerabilities/cve-2021-43552/ The use of a hard-coded cryptographic key significantly increases the possibility encrypted data may be recovered from the Patient Information Center iX (PIC iX) Versions B.02, C.02, and C.03.

The post CVE-2021-43552 appeared first on CVE Vulnerability.

]]> The use of a hard-coded cryptographic key significantly increases the possibility encrypted data may be recovered from the Patient Information Center iX (PIC iX) Versions B.02, C.02, and C.03.

The post CVE-2021-43552 appeared first on CVE Vulnerability.

]]>