CVE-2020-27688: High severity robware rvtools vulnerability

Published Nov 5, 2020

Updated

RVToolsPasswordEncryption.exe in RVTools 4.0.6 allows users to encrypt passwords to be used in the configuration files. This encryption used a static IV and key, and thus using the Decrypt() method from VISKD.cs from the RVTools.exe executable allows for decrypting the encrypted passwords. The accounts used in the configuration files have access to vSphere instances.

Affected Software

1 affected component

Robware Rvtools=4.0.6

Event History

Nov 5, 2020

CVE Published

via MITRE·02:59 PM

Data Sourced

via MITRE·02:59 PM

Description

Frequently Asked Questions

What is CVE-2020-27688?

CVE-2020-27688 is a vulnerability in RVTools 4.0.6 that allows users to decrypt encrypted passwords using a static IV and key.

How severe is CVE-2020-27688?

CVE-2020-27688 has a severity keyword of 'high' and a severity value of 7.5.

How can I fix CVE-2020-27688?

To fix CVE-2020-27688, update to a version of RVTools that is not affected, if available, or consider alternative solutions.

Where can I find more information about CVE-2020-27688?

You can find more information about CVE-2020-27688 on the GitHub page (https://github.com/matthiasmaes/CVE-2020-27688) and the RVTools website (https://www.robware.net/rvtools/).

What is the CWE for CVE-2020-27688?

The CWE for CVE-2020-27688 is CWE-522.