PT-2024-6530 · Cisco · Cisco Duo Epic For Hyperdrive

Published 2024-08-11 · Updated 2024-09-13 · CVE-2024-20503

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Cisco Duo Epic for Hyperdrive (affected versions not specified)

Description: The issue is related to insufficient protection of service data, which could allow an authenticated, local attacker to view sensitive information in cleartext on an affected system. This is due to improper storage of an unencrypted registry key. A low-privileged attacker could exploit this by viewing or querying the registry key, potentially allowing them to view sensitive information in cleartext.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Encryption of Sensitive Data

Information Disclosure

Weakness Enumeration

CWE-311

CWE-200

Related Identifiers

BDU:2024-07672

CVE-2024-20503

Affected Products

Cisco Duo Epic For Hyperdrive

References · 7

• https://osv.dev/vulnerability/CVE-2024-20503 · Vendor Advisory
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-duo-epic-info-sdLv6h8y · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-20503 · Security Note
• https://bdu.fstec.ru/vul/2024-07672 · Security Note
• https://twitter.com/VulmonFeeds/status/1831402082621956119 · Twitter Post
• https://t.me/cvedetector/4819 · Telegram Post
• https://twitter.com/CVEnew/status/1831372488187494657 · Twitter Post