PT-2020-9561 · Adrem · Adrem Netcrunch

Fabio Poloni + 2 · Published 2020-12-16 · Updated 2021-07-21 · CVE-2019-14483

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: AdRem NetCrunch version 10.6.0.4587

Description: The issue allows credentials disclosure, enabling every user to read private keys, private keys' passwords, and root passwords for BSD, Linux, MacOS, and Solaris stored in the credential manager. Additionally, every administrator can access ESX and Windows passwords stored in the credential manager.

Recommendations: For AdRem NetCrunch version 10.6.0.4587, consider restricting access to the credential manager to minimize the risk of exploitation. As a temporary workaround, limit the privileges of users and administrators to prevent unauthorized access to sensitive credentials. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2019-14483

Affected Products

Adrem Netcrunch

References · 6

• 🔥 https://compass-security.com/fileadmin/Research/Advisories/2020-17_CSNC-2019-018_AdRem_NetCrunch_Credentials_Disclosure.txt · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-14483 · Security Note
• https://osv.dev/vulnerability/CVE-2019-14483 · Vendor Advisory
• https://t.me/cvenotify/7223 · Telegram Post
• https://adremsoft.com/support · Note
• https://t.me/cibsecurity/20924 · Telegram Post