Smartit Desktop Manager
Monthly
Hard-coded credentials in Lightstar's SmartIT Desktop Manager allow unauthenticated remote attackers to authenticate with a fixed, built-in password and gain remote access to managed user hosts. Reported through TWCERT, the flaw affects all currently listed versions of the product with no version qualifier in the CPE. There is no public exploit identified at time of analysis and it is not in CISA KEV, but the trivial exploitation path (a static shared secret) makes weaponization straightforward once the credential is disclosed.
Hard-coded credentials in SmartIT Desktop Manager by Lightstar expose the AES symmetric key protecting all client-server communications. Unauthenticated remote attackers who can obtain the application binary or source - typical for distributed client software - can extract a static embedded password, use it to retrieve the AES encryption key, and subsequently decrypt the product's communication channel. Reported by TWCERT; no KEV listing and no public exploit code identified at time of analysis.
Credential disclosure in Lightstar's SmartIT Desktop Manager lets unauthenticated remote attackers extract the SSH service-account username and password for the SmartIT Agent directly from the shipped application source code (CWE-798). Because the same hard-coded SSH credentials are reused across deployments, recovering them once yields authenticated SSH access to managed agents, enabling remote command execution and full compromise of endpoints under management. No public exploit has been identified at time of analysis, but retrieval requires no more than reading the product's own code.
Hard-coded SFTP credentials embedded in SmartIT Desktop Manager (by Lightstar) allow unauthenticated remote attackers to extract credentials from application source code and authenticate directly to the SmartIT Agent's SFTP service, enabling arbitrary file system browsing on the victim host. The vulnerability is CVSS 4.0-scored at 6.9 with no-privilege, network-accessible exploitation, though real-world impact is limited to read-only directory traversal rather than full compromise. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Hard-coded credentials in Lightstar's SmartIT Desktop Manager allow unauthenticated remote attackers to authenticate with a fixed, built-in password and gain remote access to managed user hosts. Reported through TWCERT, the flaw affects all currently listed versions of the product with no version qualifier in the CPE. There is no public exploit identified at time of analysis and it is not in CISA KEV, but the trivial exploitation path (a static shared secret) makes weaponization straightforward once the credential is disclosed.
Hard-coded credentials in SmartIT Desktop Manager by Lightstar expose the AES symmetric key protecting all client-server communications. Unauthenticated remote attackers who can obtain the application binary or source - typical for distributed client software - can extract a static embedded password, use it to retrieve the AES encryption key, and subsequently decrypt the product's communication channel. Reported by TWCERT; no KEV listing and no public exploit code identified at time of analysis.
Credential disclosure in Lightstar's SmartIT Desktop Manager lets unauthenticated remote attackers extract the SSH service-account username and password for the SmartIT Agent directly from the shipped application source code (CWE-798). Because the same hard-coded SSH credentials are reused across deployments, recovering them once yields authenticated SSH access to managed agents, enabling remote command execution and full compromise of endpoints under management. No public exploit has been identified at time of analysis, but retrieval requires no more than reading the product's own code.
Hard-coded SFTP credentials embedded in SmartIT Desktop Manager (by Lightstar) allow unauthenticated remote attackers to extract credentials from application source code and authenticate directly to the SmartIT Agent's SFTP service, enabling arbitrary file system browsing on the victim host. The vulnerability is CVSS 4.0-scored at 6.9 with no-privilege, network-accessible exploitation, though real-world impact is limited to read-only directory traversal rather than full compromise. No public exploit code and no CISA KEV listing have been identified at time of analysis.