Skip to main content

Idrive CVE-2021-34688

LOW
Use of Hard-coded Credentials (CWE-798)
2021-07-15 cve@mitre.org
Authentication Bypass Information Disclosure Microsoft Idrive Remotepc
3.3
CVSS 3.1 · NVD

Severity by source

NVD PRIMARY
3.3 LOW
AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
None

Lifecycle Timeline

1
CVE Published
Jul 15, 2021 - 14:15 nvd
LOW 3.3

DescriptionNVD

iDrive RemotePC before 7.6.48 on Windows allows information disclosure. A locally authenticated attacker can read an encrypted version of the system's Personal Key in world-readable %PROGRAMDATA% log files. The encryption is done using a hard-coded static key and is therefore reversible by an attacker.

AnalysisAI

iDrive RemotePC before 7.6.48 on Windows allows information disclosure. Rated low severity (CVSS 3.3), this vulnerability is low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified as Use of Hard-coded Credentials (CWE-798), which allows attackers to gain access using credentials embedded in source code. iDrive RemotePC before 7.6.48 on Windows allows information disclosure. A locally authenticated attacker can read an encrypted version of the system's Personal Key in world-readable %PROGRAMDATA% log files. The encryption is done using a hard-coded static key and is therefore reversible by an attacker. Affected products include: Idrive Remotepc. Version information: before 7.6.48.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Remove hard-coded credentials, use environment variables or secrets management, rotate exposed credentials immediately.

More in Idrive

View all
CVE-2021-34690 CRITICAL
9.8 Jul 15

iDrive RemotePC before 7.6.48 on Windows allows authentication bypass. Rated critical severity (CVSS 9.8), this vulnerab
CVE-2026-1995 HIGH
7.8 Mar 24

IDrive's id_service.exe process, which runs with SYSTEM-level privileges on Windows systems, is vulnerable to privilege

CVE-2021-34692 HIGH
7.8 Jul 15

iDrive RemotePC before 7.6.48 on Windows allows privilege escalation. Rated high severity (CVSS 7.8), this vulnerability
CVE-2020-15351 HIGH
7.8 Jun 26

IDrive before 6.7.3.19 on Windows installs by default to %PROGRAMFILES(X86)%\IDriveWindows with weak folder permissions

CVE-2021-34691 HIGH
7.5 Jul 15

iDrive RemotePC before 4.0.1 on Linux allows denial of service. Rated high severity (CVSS 7.5), this vulnerability is re
CVE-2021-34689 MEDIUM
5.5 Jul 15

iDrive RemotePC before 7.6.48 on Windows allows information disclosure. Rated medium severity (CVSS 5.5), this vulnerabi
CVE-2021-34687 MEDIUM
5.3 Jul 15

iDrive RemotePC before 7.6.48 on Windows allows information disclosure. Rated medium severity (CVSS 5.3), this vulnerabi

Same weakness CWE-798 – Use of Hard-coded Credentials

View all
CVE-2016-1560 CRITICAL POC
9.8
CVE-2017-14143 CRITICAL POC
9.8
CVE-2026-22769 CRITICAL
10.0
CVE-2016-5678 CRITICAL POC
9.8
CVE-2017-6558 CRITICAL POC
9.8
CVE-2015-7246 CRITICAL POC
9.8
CVE-2015-4667 CRITICAL POC
9.8
CVE-2016-10177 CRITICAL POC
9.8

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3
CVE-2023-46805 HIGH POC
8.2

Share

CVE-2021-34688 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy