CVE-2022-25807

low-risk

Published 2022-06-09

An issue was discovered in the IGEL Universal Management Suite (UMS) 6.07.100. A hardcoded DES key in the LDAPDesPWEncrypter class allows an attacker, who has discovered encrypted LDAP bind credentials, to decrypt those credentials using a static 8-byte DES key.

Do I need to act?

0.05% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 5.5/10 Medium

LOCAL / LOW complexity

Affected Products (1)

Universal Management Suite

Affected Vendors

Igel

References (4)

Exploit https://github.com/atredispartners/advisories/blob/master/ATREDIS-2022-0002.md

Product https://www.igel.com/igel-solution-family/universal-management-suite/

Exploit https://github.com/atredispartners/advisories/blob/master/ATREDIS-2022-0002.md

Product https://www.igel.com/igel-solution-family/universal-management-suite/

/ 100

low-risk

Severity 18/34 · Moderate

Exploitability 0/34 · Minimal

Exposure 5/34 · Minimal