Rvtools
Monthly
Information disclosure and tampering in Dell RVTools collector versions prior to 4.8.1 stems from improper certificate validation (CWE-295), letting a remote unauthenticated attacker in a machine-in-the-middle position intercept or alter data exchanged between the collector and its target. Rated CVSS 9.1 (C:H/I:H) but with A:N, the flaw affects the popular VMware vSphere inventory-reporting utility. No public exploit is identified at time of analysis; EPSS is low at 0.14% and SSVC lists exploitation as none.
RVTools, Version 3.9.2 and above, contain a sensitive data exposure vulnerability in the password encryption utility (RVToolsPasswordEncryption.exe) and main application (RVTools.exe). Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
RVToolsPasswordEncryption.exe in RVTools 4.0.6 allows users to encrypt passwords to be used in the configuration files. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Information disclosure and tampering in Dell RVTools collector versions prior to 4.8.1 stems from improper certificate validation (CWE-295), letting a remote unauthenticated attacker in a machine-in-the-middle position intercept or alter data exchanged between the collector and its target. Rated CVSS 9.1 (C:H/I:H) but with A:N, the flaw affects the popular VMware vSphere inventory-reporting utility. No public exploit is identified at time of analysis; EPSS is low at 0.14% and SSVC lists exploitation as none.
RVTools, Version 3.9.2 and above, contain a sensitive data exposure vulnerability in the password encryption utility (RVToolsPasswordEncryption.exe) and main application (RVTools.exe). Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
RVToolsPasswordEncryption.exe in RVTools 4.0.6 allows users to encrypt passwords to be used in the configuration files. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.