EUVD-2025-17691
CVSS Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
3Description
A hardcoded key in Ivanti Workspace Control before version 10.19.10.0 allows a local authenticated attacker to decrypt stored SQL credentials.
Analysis
Credential disclosure vulnerability in Ivanti Workspace Control versions before 10.19.10.0, where a hardcoded cryptographic key enables local authenticated attackers to decrypt stored SQL database credentials. This allows privilege escalation and lateral movement within enterprise environments. With a CVSS score of 8.8 and local attack vector requiring authentication, exploitation requires internal access but poses significant risk to SQL database security and overall system compromise.
Technical Context
The vulnerability stems from CWE-321 (Use of Hard-Coded Cryptographic Key), a fundamental cryptographic implementation flaw where encryption keys are embedded in application binaries or configuration files rather than being securely derived or managed. In Ivanti Workspace Control, SQL credentials are encrypted using a hardcoded key accessible to authenticated local users. This violates cryptographic best practices where keys should be: (1) derived from secure key derivation functions, (2) stored in hardware security modules or secure credential stores, and (3) rotated regularly. An authenticated local attacker with access to the Ivanti Workspace Control application or its configuration/memory can obtain the hardcoded key, decrypt the stored SQL credentials, and gain unauthorized database access. CPE affected: ivanti:workspace_control versions <10.19.10.0.
Affected Products
Workspace Control (< 10.19.10.0)
Remediation
patch: Upgrade Ivanti Workspace Control to version 10.19.10.0 or later; priority: Critical; notes: Patch availability confirmed in CVE description; apply immediately to all affected instances mitigation_interim: Restrict local access to Ivanti Workspace Control application and configuration files using OS-level access controls (file permissions, directory restrictions); priority: High; notes: Limit which users can access the application directory and memory to reduce attack surface while patching mitigation_interim: Monitor SQL database access logs for unusual connection attempts originating from Workspace Control service accounts; priority: Medium; notes: Detect potential credential compromise in-use before full damage occurs mitigation_interim: Rotate SQL credentials stored by Ivanti Workspace Control after patching, assuming potential prior compromise; priority: High; notes: Post-patch, re-issue database credentials as a precaution detection: Scan configuration files and memory dumps for hardcoded keys (if forensically necessary pre-patch); priority: Low; notes: For forensic investigation of potential prior exploitation
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today