packetlabs/vulnerability-advisory
GitHub
Releases0
This is a documented notice that provides details about a known vulnerability in a software product. It typically includes severity ratings (CVSS), impacted versions, remediation guidance (like patches or mitigations), credits to the reporter, and disclosure timelines. Our customers can use this to follow-up on products that they may use.
CVE History
| CVE | Published | CVSS v3 | CVSS v2 |
|---|---|---|---|
| 6 MEDIUM | — | ||
ConnectWise-Password-Encryption-Utility.exe in ConnectWise Risk Assessment allows an attacker to extract a hardcoded AES decryption key via reverse engineering. This key is embedded in plaintext within the binary and used in cryptographic operations without dynamic key management. Once obtained the key can be used to decrypt CSV input files used for authenticated network scanning. | |||