PT-2020-17156 · Estil Hill · Estil Hill Lock Password Manager Safe

Published 2020-11-30 · Updated 2021-07-21 · CVE-2020-29392

Positive Technologies (AI Summary)

CVSS v3.1

4.6

Medium

Base vector

AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Estil Hill Lock Password Manager Safe app version 2.3

Description The issue allows an attacker with physical access to unlock the password manager without knowing the master password set by the user, due to a #06# backdoor password.

Recommendations For Estil Hill Lock Password Manager Safe app version 2.3, consider changing the master password and avoiding the use of the backdoor password *#06#* to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2020-29392

Affected Products

Estil Hill Lock Password Manager Safe

References · 4

• 🔥 https://i.blackhat.com/asia-20/Friday/asia-20-Loke-Patching-Loopholes-Finding-Backdoors-In-Applications.pdf · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-29392 · Security Note
• https://osv.dev/vulnerability/CVE-2020-29392 · Vendor Advisory
• https://t.me/cibsecurity/16936 · Telegram Post