Vulnerability in Faronics Winselect (Standard + Enterprise)
CVE-2024-36496
The configuration file is encrypted with a static key derived from a static five-character password which allows an attacker to decrypt this file. The application hashes this five-character password with the outdated and broken MD5 algorithm (no salt) and uses the first five bytes as the key for RC4. The configuration file is then encrypted with these parameters.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.
EPSS exploit prediction
EPSS: 0.007 (51.0th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 51st percentile — 51.0% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.007 · newest: 0.007 · change: 0.000
Affected products
- Faronics Winselect (Standard + Enterprise) — versions 8.30.xx.903
Weakness classification (CWE)
References
- 551230f0-3615-47bd-b7cc-93e92e730bbf (exploit, third-party-advisory)
- 551230f0-3615-47bd-b7cc-93e92e730bbf (release-notes)
- 551230f0-3615-47bd-b7cc-93e92e730bbf
Frequently asked questions
- What is CVE-2024-36496?
- CVE-2024-36496 is a high-severity vulnerability in Faronics Winselect (Standard + Enterprise), classified under Use of Hard-coded Credentials. CVSS score: 7.5/10. Published 2024-06-24.
- How severe is CVE-2024-36496?
- High severity. CVSS v3 base score is 7.5 out of 10.