Vulnerability in Notify Technology Notifylink

CVE-2005-0809

NotifyLink, when configured for client key retrieval, allows remote attackers to obtain AES keys via a direct request to /hwp/get.asp, then uses a weak encryption scheme (fixed byte reordering) to protect the key, which allows remote attackers to obtain the key via a brute force attack.

EPSS: 0.012 (65.0th percentile) — read the EPSS interpretation.

Affected products

Notify_technology Notifylink — versions enterprise_server
N/a — versions n/a

References

cve@mitre.org (x_refsource_SECUNIA, third-party-advisory)
cve@mitre.org (US Government Resource, x_refsource_CERT-VN, Third Party Advisory, third-party-advisory)
cve@mitre.org (vdb-entry, x_refsource_BID)