Mijo Mišić

**Name of the Vulnerable Software and Affected Versions** PDBM (affected versions not specified) **Description** The application uses a static, hard-coded secret within the PDBM.exe executable for its encryption routines. This secret is utilized by the function responsible for decrypting credentials stored in the configuration file. An attacker with local privileges can extract this constant secret from the binary to decrypt the stored password. Since the associated user account is configured with administrative privileges, this allows for full access to the management interface and operational functions. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions MEPIS RM (affected versions not specified) Description A security issue was found in MEPIS RM, an industrial software product by Metronik. The software includes a hardcoded cryptographic key within the `Mx.Web.ComponentModel.dll` component. When the option to store domain passwords is enabled, this key is used to encrypt user passwords before they are stored in the application’s database. An attacker with the necessary privileges to access the database could extract the encrypted passwords, decrypt them using the embedded key, and gain unauthorized access to the associated ICS/OT environment. Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.