PT-2024-19548 · Amcs · Trux Waste Management

Bryan Smith + 1 · Published 2024-04-09 · Updated 2025-06-17 · CVE-2024-22734

Positive Technologies (AI Summary)

CVSS v3.1

6.2

Medium

Base vector

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions AMCS Group Trux Waste Management Software versions prior to 7.19.0018.26912

Description An issue in the Trux Waste Management Software allows local attackers to obtain sensitive information via a static, hard-coded AES Key-IV pair in the TxUtilities.dll and TruxUser.cfg components. This could allow attackers with local network access to take complete control of the application and gain unrestricted access to sensitive ERP databases.

Recommendations For versions prior to 7.19.0018.26912, update to version 7.19.0018.26912 or later to resolve the issue. As a temporary workaround, consider restricting access to the TxUtilities.dll and TruxUser.cfg components to minimize the risk of exploitation.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2024-22734

Affected Products

Trux Waste Management

References · 13

• 🔥 https://redlinecybersecurity.com/blog/cve-2024-22734 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-22734 · Security Note
• https://osv.dev/vulnerability/CVE-2024-22734 · Vendor Advisory
• https://twitter.com/securekomodo/status/1777713077716222134 · Twitter Post
• https://twitter.com/Dinosn/status/1778993102574760072 · Twitter Post
• https://t.me/thedarkwebinformer/8295 · Telegram Post
• https://t.me/cvenotify/85354 · Telegram Post
• https://t.me/pentestingnews/45832 · Telegram Post
• https://twitter.com/CVEnew/status/1779016060194480190 · Twitter Post
• https://twitter.com/Komodosec/status/1779183309182161153 · Twitter Post
• https://t.me/cvenotify/126029 · Telegram Post
• https://t.me/cvenotify/76520 · Telegram Post
• https://twitter.com/the_yellow_fall/status/1778965657369072121 · Twitter Post