Upsignon
Monthly
Cleartext vault data in UpSignOn for Windows before 7.19.0 persists in process memory after the application locks, exposing all stored secrets to any local attacker with standard user privileges. Using the Windows PROCESS_VM_READ permission, an attacker can call ReadProcessMemory() against UpSignOn.exe and extract entry names, URLs, usernames, passwords, TOTP secrets, and notes in plaintext - defeating the lock screen's security guarantee. No public exploit code is identified at time of analysis and no CISA KEV listing exists, but the technique is well within the reach of any attacker with local access to the workstation.
Insecure credential storage in UpSignOn for Windows (before 7.19.0) exposes the biometric unlock key from the Windows PasswordVault API to any standard process running in the same user session, requiring no authentication prompt. An attacker with low-privilege local code execution can retrieve this key, decrypt the protected vault files on disk, and export the entire password manager contents in cleartext. No public exploit has been identified at time of analysis, and the vendor-released patch is available in version 7.19.0.
Sensitive key retention in UpSignOn for Windows before 7.19.0 allows a local attacker with low privileges to recover the master password and decrypt the entire password vault. The backup key used to protect an encrypted master password backup is retained in the memory of UpSignOn.exe even after the vault is re-locked, enabling an attacker who can read process memory to extract it, decrypt the master password backup stored in v6-vault1.DATA.txt, and subsequently export all stored credentials in cleartext. No public exploit has been identified at time of analysis, but the attack chain is mechanically straightforward once local access is established.
Cleartext vault data in UpSignOn for Windows before 7.19.0 persists in process memory after the application locks, exposing all stored secrets to any local attacker with standard user privileges. Using the Windows PROCESS_VM_READ permission, an attacker can call ReadProcessMemory() against UpSignOn.exe and extract entry names, URLs, usernames, passwords, TOTP secrets, and notes in plaintext - defeating the lock screen's security guarantee. No public exploit code is identified at time of analysis and no CISA KEV listing exists, but the technique is well within the reach of any attacker with local access to the workstation.
Insecure credential storage in UpSignOn for Windows (before 7.19.0) exposes the biometric unlock key from the Windows PasswordVault API to any standard process running in the same user session, requiring no authentication prompt. An attacker with low-privilege local code execution can retrieve this key, decrypt the protected vault files on disk, and export the entire password manager contents in cleartext. No public exploit has been identified at time of analysis, and the vendor-released patch is available in version 7.19.0.
Sensitive key retention in UpSignOn for Windows before 7.19.0 allows a local attacker with low privileges to recover the master password and decrypt the entire password vault. The backup key used to protect an encrypted master password backup is retained in the memory of UpSignOn.exe even after the vault is re-locked, enabling an attacker who can read process memory to extract it, decrypt the master password backup stored in v6-vault1.DATA.txt, and subsequently export all stored credentials in cleartext. No public exploit has been identified at time of analysis, but the attack chain is mechanically straightforward once local access is established.