Cryptobox EUVD-2026-28342

The vulnerability requires (1) knowledge or enumeration of a valid Cryptobox external sharing link URL, and (2) the Cryptobox instance must be network-accessible (not air-gapped). No authentication credentials are required. The attack does not depend on non-default configuration - the external sharing feature is likely enabled by default in typical deployments. The information disclosure that enables offline brute-force occurs during normal usage of the sharing link feature, meaning the attacker does not need special permissions or roles within Cryptobox. The limiting factor is that sharing links are typically unpredictable URLs; however, once obtained (e.g., via email interception, web server log access, or social engineering), they are valid indefinitely unless explicitly revoked, increasing the window for exploitation.

CVSS 6.9 with network accessibility (AV:N), low complexity (AC:L), and no authentication required (PR:N) indicates a practical attack surface. The vector specifies low confidentiality impact (VC:L) and no integrity or availability impact, confirming information disclosure as the primary threat. The absence of user interaction (UI:N) and non-atomicity trigger (AT:N) mean exploitation is straightforward. However, real-world risk depends on (1) how much entropy the leaked information reveals about the access code, (2) whether access codes use weak randomization, and (3) how many sharing links an attacker can enumerate. EPSS score and KEV status were not provided in input data, limiting assessment of exploitation prevalence. The attack requires prior knowledge of a valid sharing link URL, which is a minor limiting factor - sharing links may be accidentally exposed via email, chat, or web server logs. Defenders should prioritize patching if they host externally-accessible Cryptobox instances with sensitive shared content.

An attacker discovers a Cryptobox sharing link via accidental exposure in a forwarded email or web cache. The attacker sends an HTTP GET request to the sharing link endpoint and analyzes the server response for information leakage (e.g., response length, timing, partial validation logic). Using this information, the attacker runs an offline brute-force attack against the access code on their local machine, recovering it within hours to days depending on code entropy. The attacker then accesses the shared content without authorization.