{"id":"CVE-2024-36496","aliases":["EUVD-2024-36125","GHSA-jm6p-8vc7-99q9"],"status":"published","title":"Hardcoded Credentials","description":"The configuration file is encrypted with a static key derived from a \nstatic five-character password which allows an attacker to decrypt this \nfile. The application hashes this five-character password with \nthe outdated and broken MD5 algorithm (no salt) and uses the first five \nbytes as the key for RC4. The configuration file is then encrypted with \nthese parameters.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-12","score":0.00693,"percentile":0.53401,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-798"],"published":"2024-06-24T09:04:18Z","modified":"2026-06-17T07:36:50Z","products":[{"vendor":"faronics","product":"winselect"},{"vendor":"faronics","product":"winselect (standard + enterprise)"}],"references":[{"url":"https://r.sec-consult.com/winselect","tags":["third-party-advisory","exploit","x_transferred"]},{"url":"https://www.faronics.com/en-uk/document-library/document/winselect-standard-release-notes","tags":["release-notes","x_transferred"]},{"url":"http://seclists.org/fulldisclosure/2024/Jun/12","tags":["x_transferred"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-36496"},{"url":"https://github.com/advisories/GHSA-jm6p-8vc7-99q9"}],"sources":{"cve":[{"id":"CVE-2024-36496","title":"Hardcoded Credentials","description":"The configuration file is encrypted with a static key derived from a \nstatic five-character password which allows an attacker to decrypt this \nfile. The application hashes this five-character password with \nthe outdated and broken MD5 algorithm (no salt) and uses the first five \nbytes as the key for RC4. The configuration file is then encrypted with \nthese parameters.","status":"published","published":"2024-06-24T09:04:18.257Z","modified":"2025-02-13T17:52:55.434Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"adp"}],"cwes":["CWE-798"],"updated_at":"2026-11-02T14:34:14.985673Z"}],"euvd":[{"id":"EUVD-2024-36125","description":"The configuration file is encrypted with a static key derived from a \nstatic five-character password which allows an attacker to decrypt this \nfile. The application hashes this five-character password with \nthe outdated and broken MD5 algorithm (no salt) and uses the first five \nbytes as the key for RC4. The configuration file is then encrypted with \nthese parameters.","status":"published","published":"2024-06-24T09:04:18Z","modified":"2025-02-13T17:52:55Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T20:53:31.829035Z"}],"ghsa":[{"id":"GHSA-jm6p-8vc7-99q9","title":"The configuration file is encrypted with a static key derived from a \nstatic five-character...","description":"The configuration file is encrypted with a static key derived from a \nstatic five-character password which allows an attacker to decrypt this \nfile. The application hashes this five-character password with \nthe outdated and broken MD5 algorithm (no salt) and uses the first five \nbytes as the key for RC4. The configuration file is then encrypted with \nthese parameters.","status":"published","published":"2024-06-24T09:30:53Z","modified":"2024-07-03T18:47:38Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-798"],"updated_at":"2026-11-02T14:57:38.140316Z"}],"nvd":[{"id":"CVE-2024-36496","description":"The configuration file is encrypted with a static key derived from a \nstatic five-character password which allows an attacker to decrypt this \nfile. The application hashes this five-character password with \nthe outdated and broken MD5 algorithm (no salt) and uses the first five \nbytes as the key for RC4. The configuration file is then encrypted with \nthese parameters.","status":"published","published":"2024-06-24T09:15:09.86Z","modified":"2026-06-17T07:36:50.617Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-798"],"updated_at":"2026-11-02T14:10:07.173605Z"}]}}