What is the CVSS score of CVE-2026-37454?

CVE-2026-37454 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.1%.

Which versions of MSI NBFoundation Service are affected by CVE-2026-37454?

MSI NBFoundation Service v2.0.2506.1201 contains a cryptographic weakness allowing remote attackers to access sensitive organizational data without authentication through insecure 3DES-ECB encryption…

How to fix or mitigate CVE-2026-37454?

Within 24 hours, inventory all systems running MSI NBFoundation Service v2.0.2506.1201 and immediately isolate them from untrusted networks and internet connectivity. Within 7 days, implement network segmentation and access controls to restrict remote connectivity to this service, deploy IPS/WAF signatures to detect exploitation attempts, and enable comprehensive audit logging on affected systems. Within 30 days, develop and execute a remediation plan to upgrade to a patched version of MSI NBFoundation Service once available from the vendor, or transition to an alternative solution if vendor patching remains unavailable beyond this window.

MSI NBFoundation Service CVE-2026-37454

HIGH

Information Exposure (CWE-200)

2026-06-25 mitre

Information Disclosure N A

7.5

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Retained AV:N per input given remote framing, PR:N/UI:N as no auth is described, confidentiality-only impact (C:H, I:N/A:N) matching an information-disclosure crypto weakness.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 20:18 vuln.today

CVE Published

Jun 25, 2026 - 00:00 cve.org

HIGH 7.5

CVE Published

Jun 25, 2026 - 00:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Insecure Permissions vulnerability in MSI NBFoundation Service v.2.0.2506.1201 allows a remote attacker to obtain sensitive information via the 3DES-ECB encryption

AnalysisAI

Sensitive information disclosure in MSI NBFoundation Service v2.0.2506.1201 lets remote attackers recover confidential data protected by the service's weak 3DES-ECB encryption scheme. The ECB cipher mode leaks structural patterns and, combined with insecure permissions (CWE-200), exposes data an attacker can decrypt or infer without authentication. No public exploit is identified at time of analysis, though a GitHub research repository is referenced and EPSS remains low (0.15%).

Technical ContextAI

NBFoundation Service is a background/system component bundled with MSI (Micro-Star International) motherboard and laptop management/utility software on Windows. The root cause class is CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), manifested through cryptographic weakness: the service encrypts sensitive data using Triple DES in Electronic Codebook (ECB) mode. ECB is deterministic and encrypts identical plaintext blocks to identical ciphertext blocks, leaking data patterns and enabling block-level inference or replay; 3DES additionally has only a 64-bit block size (Sweet32 exposure). CPE data is uninformative here (cpe:2.3:a:n/a:n/a - a placeholder with no real vendor/product mapping), so the affected component identity rests on the description and the MSI advisory rather than structured NVD CPE.

RemediationAI

No vendor-released patch version is identified at time of analysis from the provided data; consult the MSI Product Security Advisories page (https://csr.msi.com/global/product-security-advisories) for a fixed build superseding 2.0.2506.1201 and upgrade to it once published. As compensating controls until a patch is confirmed: restrict or block network access to the NBFoundation Service's listening interface/port at the host firewall so only trusted local processes can reach it (side effect: may break legitimate MSI management features that depend on the service); where the service is not needed, disable or uninstall the NBFoundation Service component (side effect: loss of associated MSI utility functionality); and avoid transmitting or storing sensitive data through this component while the weak 3DES-ECB scheme remains in place. The referenced GitHub repository (https://github.com/LittleSuRii/CVE-2026-MSIAPService) is security research, not an official fix, and should not be relied on as remediation.