CVE-2018-18466: High severity shearwater securenvoy securaccess vulnerability
DISPUTED An issue was discovered in SecurEnvoy SecurAccess 9.3.502. When put in Debug mode and used for RDP connections, the application stores the emergency credentials in cleartext in the logs (present in the DEBUG folder) that can be accessed by anyone. NOTE: The vendor disputes this as a vulnerability since the disclosure of a local account password (actually an alpha numeric passcode) is achievable only when a custom registry key is added to the windows registry. This action requires administrator access and the registry key is only provided by support staff at securenvoy to troubleshoot customer issues.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2018-18466?
CVE-2018-18466 is considered to have a medium severity due to the exposure of sensitive emergency credentials in cleartext.
How do I fix CVE-2018-18466?
To mitigate CVE-2018-18466, avoid running SecurEnvoy SecurAccess in Debug mode or ensure that log files are secured and accessible only to authorized personnel.
What are the potential impacts of CVE-2018-18466?
The potential impacts of CVE-2018-18466 include unauthorized access to sensitive emergency credentials that may compromise RDP connections.
Which software versions are affected by CVE-2018-18466?
CVE-2018-18466 specifically affects SecurEnvoy SecurAccess version 9.3.502.
Is the vendor’s response documented for CVE-2018-18466?
Yes, the vendor disputes the claim regarding CVE-2018-18466, indicating a need for careful consideration of their statements.