CVE-2024-36496 - CVE House
Back to Database
Status published Unknown CVE-2024-36496

Hardcoded Credentials

Vulnerability Description

The configuration file is encrypted with a static key derived from a static five-character password which allows an attacker to decrypt this file. The application hashes this five-character password with the outdated and broken MD5 algorithm (no salt) and uses the first five bytes as the key for RC4. The configuration file is then encrypted with these parameters.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-36496

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • Daniel Hirschberger | SEC Consult Vulnerability Lab

References

More from Faronics

View All →
CVE-2024-8159
Deep Freeze 9.00.020.5760 - Out-of-bounds read
Medium 6.4
CVE-2024-36497
Unhashed Storage of Password
Unknown 0
CVE-2024-36495
Read/Write Permissions for Everyone on Configuration File
Unknown 0
CVE-2024-1618
Unquoted item or search path vulnerability in Faronics Deep Freeze Server Standard
High 7.8

Affected Vendor

Affected Software

WINSelect (Standard + Enterprise)
Vulnerable Versions:
8.30.xx.903

Timeline

Official Publish: June 24th, 2024
Last Modified: February 13th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

No vector data available

Weaknesses (CWE)

CWE-798

MITRE ATT&CK TTPs

T1552 Unsecured Credentials
Credential Access
T1078 Valid Accounts
Persistence
T1021 Remote Services
Lateral Movement
T1190 Exploit Public-Facing Application
Initial Access
T1098 Account Manipulation
Privilege Escalation