Lansweeper lsrunase CVE-2026-39031
MEDIUMSeverity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Local filesystem read with low privileges deterministically recovers credentials; no integrity or availability impact applies.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
2DescriptionCVE.org
Lansweeper lsrunase 2.0 and lsencrypt 2.0 use RC4 encryption with a hardcoded 142-byte static key array to encrypt credentials. An 8-character prefix is stored in cleartext alongside the ciphertext. This allows an attacker with local access to recover any encrypted password to plaintext using a single SHA-1 hash and RC4 decryption operation, with no brute force required.
AnalysisAI
Trivial credential recovery is possible against Lansweeper lsrunase 2.0 and lsencrypt 2.0 due to RC4 encryption with a hardcoded 142-byte static key embedded in the binaries. Any local attacker who can read the encrypted credential store can recover plaintext passwords using a single SHA-1 hash computation followed by RC4 decryption - no brute force, dictionary attack, or key material theft required. A public proof-of-concept exists on GitHub (no public exploit identified as confirmed actively exploited at time of analysis), and SSVC classifies this as non-automatable with partial technical impact, making it a targeted but deterministic threat to environments that rely on these utilities for credential storage.
Technical ContextAI
CWE-321 (Use of Hard-coded Cryptographic Key) governs this flaw. RC4 (Rivest Cipher 4) is a stream cipher long considered cryptographically broken; its use here is compounded by a static 142-byte key compiled into the lsrunase 2.0 and lsencrypt 2.0 binaries, meaning the key is identical across every deployment worldwide. An additional design flaw stores an 8-character prefix alongside the ciphertext in cleartext, providing known-plaintext material that would further facilitate decryption. The decryption procedure requires only a SHA-1 hash operation and one pass of RC4 - both trivially implemented in any scripting language. Lansweeper is an IT asset management and network discovery platform; lsrunase and lsencrypt appear to be credential-handling utilities within that ecosystem. The NVD CPE entry is listed as 'n/a', indicating the affected product has not been formally catalogued, which limits automated scanner coverage of this vulnerability.
RemediationAI
No vendor-released patch identified at time of analysis. Organizations should immediately audit whether lsrunase 2.0 or lsencrypt 2.0 are in use and what credentials they protect. As a primary compensating control, discontinue use of these utilities for credential storage and migrate to a supported secrets management solution (e.g., a password vault or OS credential store). If immediate migration is not feasible, restrict filesystem read access to any encrypted credential files produced by these utilities to the minimum necessary accounts, reducing the pool of potential low-privilege attackers who can exploit the flaw - note this does not eliminate the risk if any authorized local user is a threat actor. Additionally, rotate any passwords that may have been encrypted by these tools, since there is no way to determine retrospectively whether an attacker has already decrypted them. Monitor the VulDB advisory at https://vuldb.com/vuln/374417 and the researcher disclosure at https://usermode.net/cve/lansweeper_lsrunase2_lsencrypt2_cve.pdf for any vendor response or patch release.
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Same weakness CWE-321 – Use of Hard-coded Cryptographic Key
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today