AxxonNet ARP Agent CVE-2026-121023

Requires local read access to the ARP Agent's log files or to a generated support/diagnostic package on a Windows or Linux host running AxxonNet before 3.25.0. The sensitive data appears only when LDAP user synchronization is configured and active, because the plaintext LDAP directory-service account password is written into WARNING-level entries containing serialized user-synchronization data. Limiting factors: exploitation is not remote (AV:L) and demands a pre-existing low-privilege foothold with log-read permission (PR:L); environments that do not use LDAP synchronization, or that restrict log/support-bundle access, are not exposed. No user interaction is required (UI:N).

This is a moderate, locally-scoped information-disclosure issue (CWE-532), not an urgent remote-exploitation priority. The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N, 6.8) confirms the flaw is local and requires the attacker to already hold some privilege (PR:L) - specifically read access to ARP Agent log files or support packages. Impact is confidentiality-only (VC:H), reflecting that a high-value secret - the plaintext LDAP directory-service account password - is exposed, while integrity and availability are untouched. The vuln.today decision label is 'this_month' (not act_now/emergency), consistent with a serious-but-not-fire-drill item. No EPSS score, no CISA KEV listing, and no PoC reference were supplied, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The real risk is contextual: the disclosed LDAP credential can be reused to pivot into the directory service and beyond, so the practical blast radius exceeds the modest base score - but only once an attacker has gained log-read access, which itself presupposes a foothold or insider position. Note the CVSS 4.0 vector sets subsequent-system metrics to N even though a stolen domain/LDAP credential plausibly enables lateral movement into a separate authority; treat the directory-compromise potential as an operational consideration beyond the raw score.

A low-privileged user, local service account, or support engineer with access to the host reads the ARP Agent WARNING-level logs (or a collected diagnostic support package) and extracts the serialized user-synchronization data, which embeds the LDAP service account password in plaintext. Because the attack vector is local with low complexity and only low privilege required, no user interaction or exploit code is needed - simple log file access suffices. No public exploit is identified at time of analysis.