Critical severity · published Dec 16, 2020
CVE-2019-14482
AdRem NetCrunch 10.6.0.4587 has a hardcoded SSL private key vulnerability in the NetCrunch web client
9.8
CVSS
1.8%
EPSS
No
On KEV
Description
AdRem NetCrunch 10.6.0.4587 has a hardcoded SSL private key vulnerability in the NetCrunch web client. The same hardcoded SSL private key is used across different customers' installations when no other SSL certificate is installed, which allows remote attackers to defeat cryptographic protection mechanisms by leveraging knowledge of this key from another installation.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.8% · higher than 78% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NE
Netcrunch · Adremsoft
through 10.6.0.4587 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-14482
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-14482
Exploit
https://compass-security.com/fileadmin/Research/Advisories/2020-16_CSNC-2019-017_AdRem_NetCrunch_Hardcoded_SSL_Private_Key.txt
Product
https://www.adremsoft.com/support/
More from Netcrunch
9.8
CVE-2019-14480
AdRem NetCrunch 10.6.0.4587 has an Improper Session Handling vulnerability in the NetCrunch web client, which can lead to an authentication bypass or escalation of privileges
8.8
CVE-2019-14479
AdRem NetCrunch 10.6.0.4587 allows Remote Code Execution
8.8
CVE-2019-14483
AdRem NetCrunch 10.6.0.4587 allows Credentials Disclosure
6.5
CVE-2019-14476
AdRem NetCrunch 10.6.0.4587 has a Server-Side Request Forgery (SSRF) vulnerability in the NetCrunch server
5.5
CVE-2019-14477
AdRem NetCrunch 10.6.0.4587 has Improper Credential Storage since the internal user database is readable by low-privileged users and passwords in the database are weakly encoded…