CVE-2013-1352

Related Files

Verax NMS Hardcoded Private Key

Posted Mar 7, 2013

Authored by Andrew Brooks

In versions prior to 2.1.0 of VeraxNMS, the server-side component eadministratorconsole-core-1.5.2.jar, contains a method named decryptPassword(). This method provides the functionality to decrypt a user's password using an implementation of RSA. Within com.veraxsystems.eadministratorconsole.remote.service.impl, it has been discovered that decryptPassword() uses a static, hardcoded private key to facilitate this process. As a result, these passwords should be considered insecure due to the fact that recovering the private key is decidedly trivial.

tags | exploit, remote

advisories | CVE-2013-1352

SHA-256 | 55feaa6ff716167b15cd4b70dd26eae40f7ecebefd6e0d42d6e9cc2abd1cd56a

Download | Favorite | View