Symantec Ghost Solution Suite
Monthly
Credential disclosure in Symantec Ghost Solution Suite's GSS Deployment Server lets an attacker who possesses the product's hardcoded cryptographic key decrypt domain and service-account passwords, task run-as credentials and sysprep passwords that the component stores or transmits. The builds identified by EUVD are GSS 3.3.13, GSS 3.3 RU11 and GSS 3.3 RU12 (CPE cpe:2.3:a:broadcom:symantec_ghost_solution_suite), and exploitation is limited to attackers with an adjacent-network position who can also obtain the credential ciphertext - either by intercepting passwords sent by the Deployment Server or by reading the encrypted credential store on an installation. Severity is rated 6.8 under CVSS 4.0 (independent assessment: CVSS 3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L); there is no KEV listing, no public exploit identified at time of analysis, and EPSS is 0.15% (4th percentile).
Credential disclosure in Symantec Ghost Solution Suite's GSS Deployment Server lets an attacker who possesses the product's hardcoded cryptographic key decrypt domain and service-account passwords, task run-as credentials and sysprep passwords that the component stores or transmits. The builds identified by EUVD are GSS 3.3.13, GSS 3.3 RU11 and GSS 3.3 RU12 (CPE cpe:2.3:a:broadcom:symantec_ghost_solution_suite), and exploitation is limited to attackers with an adjacent-network position who can also obtain the credential ciphertext - either by intercepting passwords sent by the Deployment Server or by reading the encrypted credential store on an installation. Severity is rated 6.8 under CVSS 4.0 (independent assessment: CVSS 3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L); there is no KEV listing, no public exploit identified at time of analysis, and EPSS is 0.15% (4th percentile).