Vulnerability in Faronics Winselect (Standard + Enterprise)
CVE-2024-36496
The configuration file is encrypted with a static key derived from a static five-character password which allows an attacker to decrypt this file. The application hashes this five-character password with the outdated and broken MD5 algorithm (no salt) and uses the first five bytes as the key for RC4. The configuration file is then encrypted with these parameters.
EPSS: 0.007 (49.2th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.
Affected products
- Faronics Winselect (Standard + Enterprise) — versions 8.30.xx.903
Weakness classification (CWE)
References
- 551230f0-3615-47bd-b7cc-93e92e730bbf (exploit, third-party-advisory)
- 551230f0-3615-47bd-b7cc-93e92e730bbf (release-notes)
- 551230f0-3615-47bd-b7cc-93e92e730bbf
Frequently asked questions
- What is CVE-2024-36496?
- CVE-2024-36496 is a high-severity vulnerability in Faronics Winselect (Standard + Enterprise), classified under Use of Hard-coded Credentials. CVSS score: 7.5/10. Published 2024-06-24.
- How severe is CVE-2024-36496?
- High severity. CVSS v3 base score is 7.5 out of 10.