What is the CVSS score of CVE-2024-45165?

CVE-2024-45165 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.2%.

Idol2 CVE-2024-45165

MEDIUM

Use of Hard-coded Credentials (CWE-798)

2024-08-22 cve@mitre.org

Authentication Bypass Idol2

5.3

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

5.3 MEDIUM

AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from Vendor (mitre) · only source for this CVE.

CVSS VectorVendor: mitre

CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Adjacent

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

CVE Published

Aug 22, 2024 - 04:15 cve.org

MEDIUM 5.3

DescriptionCVE.org

An issue was discovered in UCI IDOL 2 (aka uciIDOL or IDOL2) through 2.12. Data is sent between client and server with encryption. However, the key is derived from the string "(c)2007 UCI Software GmbH B.Boll" (without quotes). The key is both static and hardcoded. With access to messages, this results in message decryption and encryption by an attacker. Thus, it enables passive and active man-in-the-middle attacks.

AnalysisAI

An issue was discovered in UCI IDOL 2 (aka uciIDOL or IDOL2) through 2.12. Rated medium severity (CVSS 5.3), this vulnerability is no authentication required. No vendor patch available.

Technical ContextAI

This vulnerability is classified as Use of Hard-coded Credentials (CWE-798), which allows attackers to gain access using credentials embedded in source code. An issue was discovered in UCI IDOL 2 (aka uciIDOL or IDOL2) through 2.12. Data is sent between client and server with encryption. However, the key is derived from the string "(c)2007 UCI Software GmbH B.Boll" (without quotes). The key is both static and hardcoded. With access to messages, this results in message decryption and encryption by an attacker. Thus, it enables passive and active man-in-the-middle attacks. Affected products include: Uci Idol2. Version information: through 2.12..

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Remove hard-coded credentials, use environment variables or secrets management, rotate exposed credentials immediately.