PT-2020-9560 · Adrem · Adrem Netcrunch

Fabio Poloni + 2 · Published 2020-12-16 · Updated 2020-12-17 · CVE-2019-14482

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: AdRem NetCrunch version 10.6.0.4587

Description: The issue is related to a hardcoded SSL private key vulnerability in the NetCrunch web client. This hardcoded key is used across different customers' installations when no other SSL certificate is installed. As a result, remote attackers can defeat cryptographic protection mechanisms by leveraging knowledge of this key from another installation.

Recommendations: For AdRem NetCrunch version 10.6.0.4587, consider replacing the hardcoded SSL private key with a unique certificate for each installation to prevent exploitation. Additionally, restrict access to the NetCrunch web client until a proper SSL certificate is installed.

Exploit

Fix

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

CVE-2019-14482

Affected Products

Adrem Netcrunch

References · 6

• 🔥 https://compass-security.com/fileadmin/Research/Advisories/2020-16_CSNC-2019-017_AdRem_NetCrunch_Hardcoded_SSL_Private_Key.txt · Exploit
• https://osv.dev/vulnerability/CVE-2019-14482 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-14482 · Security Note
• https://t.me/cibsecurity/20926 · Telegram Post
• https://t.me/cvenotify/7221 · Telegram Post
• https://adremsoft.com/support · Note