CVE-2023-20038: cisco cisco industrial network director Use of Hard-coded Cryptographic Key

Vulnerability summary

CVE-2023-20038 is a high (CVSS 8.8) Use of Hard-coded Cryptographic Key vulnerability in cisco cisco industrial network director. EPSS estimates a 0.16% chance of exploitation in the next 30 days, higher than 4.9% of scored vulnerabilities.

Timeline

1. 19-01-2023
   PublishedVulnerability first disclosed.
2. 28-10-2024
   Last modifiedVulnerability information updated.

Description

A vulnerability in the monitoring application of Cisco Industrial Network Director could allow an authenticated, local attacker to access a static secret key used to store both local data and credentials for accessing remote systems. This vulnerability is due to a static key value stored in the application used to encrypt application data and remote credentials. An attacker could exploit this vulnerability by gaining local access to the server Cisco Industrial Network Director is installed on. A successful exploit could allow the attacker to decrypt data allowing the attacker to access remote systems monitored by Cisco Industrial Network Director.

• CWE-321Use of Hard-coded Cryptographic KeyThe product uses a hard-coded, unchangeable cryptographic key.
• CWE-798Use of Hard-coded CredentialsThe product contains hard-coded credentials, such as a password or cryptographic key.