What is the CVSS score of CVE-2025-5353?

CVE-2025-5353 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Workspace Control are affected by CVE-2025-5353?

Ivanti Workspace Control versions prior to 10.19.10.0 contain a hardcoded encryption key that allows authenticated local users to decrypt SQL database credentials, potentially exposing backend…

How to fix or mitigate CVE-2025-5353?

Within 24 hours: Inventory all Ivanti Workspace Control deployments and identify instances running versions before 10.19.10.0; restrict local administrative access to affected systems and review access logs for suspicious activity. Within 7 days: Implement network segmentation to isolate Workspace Control servers from sensitive database systems; rotate all SQL credentials managed by affected Workspace Control instances and update connection strings in dependent systems. Within 30 days: Upgrade all affected Ivanti Workspace Control instances to version 10.19.10.0 or later once patching resources are available; conduct credential audit to identify any unauthorized access.

Workspace Control CVE-2025-5353

EUVD-2025-17691 HIGH

Use of Hard-coded Cryptographic Key (CWE-321)

2025-06-10 3c1d8aa1-5a33-4ea4-8992-aadd6440af75

Information Disclosure Ivanti Authentication Bypass Workspace Control

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

EUVD ID Assigned

Mar 14, 2026 - 19:49 euvd

EUVD-2025-17691

Analysis Generated

Mar 14, 2026 - 19:49 vuln.today

CVE Published

Jun 10, 2025 - 15:15 nvd

HIGH 8.8

DescriptionCVE.org

A hardcoded key in Ivanti Workspace Control before version 10.19.10.0 allows a local authenticated attacker to decrypt stored SQL credentials.

AnalysisAI

Credential disclosure vulnerability in Ivanti Workspace Control versions before 10.19.10.0, where a hardcoded cryptographic key enables local authenticated attackers to decrypt stored SQL database credentials. This allows privilege escalation and lateral movement within enterprise environments. With a CVSS score of 8.8 and local attack vector requiring authentication, exploitation requires internal access but poses significant risk to SQL database security and overall system compromise.

Technical ContextAI

The vulnerability stems from CWE-321 (Use of Hard-Coded Cryptographic Key), a fundamental cryptographic implementation flaw where encryption keys are embedded in application binaries or configuration files rather than being securely derived or managed. In Ivanti Workspace Control, SQL credentials are encrypted using a hardcoded key accessible to authenticated local users. This violates cryptographic best practices where keys should be: (1) derived from secure key derivation functions, (2) stored in hardware security modules or secure credential stores, and (3) rotated regularly. An authenticated local attacker with access to the Ivanti Workspace Control application or its configuration/memory can obtain the hardcoded key, decrypt the stored SQL credentials, and gain unauthorized database access. CPE affected: ivanti:workspace_control versions <10.19.10.0.

RemediationAI

patch: Upgrade Ivanti Workspace Control to version 10.19.10.0 or later; priority: Critical; notes: Patch availability confirmed in CVE description; apply immediately to all affected instances mitigation_interim: Restrict local access to Ivanti Workspace Control application and configuration files using OS-level access controls (file permissions, directory restrictions); priority: High; notes: Limit which users can access the application directory and memory to reduce attack surface while patching mitigation_interim: Monitor SQL database access logs for unusual connection attempts originating from Workspace Control service accounts; priority: Medium; notes: Detect potential credential compromise in-use before full damage occurs mitigation_interim: Rotate SQL credentials stored by Ivanti Workspace Control after patching, assuming potential prior compromise; priority: High; notes: Post-patch, re-issue database credentials as a precaution detection: Scan configuration files and memory dumps for hardcoded keys (if forensically necessary pre-patch); priority: Low; notes: For forensic investigation of potential prior exploitation