CVE-2024-36496

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

The configuration file is encrypted with a static key derived from a static five-character password which allows an attacker to decrypt this file. The application hashes this five-character password with the outdated and broken MD5 algorithm (no salt) and uses the first five bytes as the key for RC4. The configuration file is then encrypted with these parameters.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-798

Affected software

No affected versions have been published.

Timeline

Published: Jun 24, 2024
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2024

CVE-2024-364979.1The decrypted configuration file contains the password in cleartext which is used to configure WINSelect. It can be used to remove the exi CVE-2024-364984.7Due to missing input sanitization, an attacker can perform cross-site-scripting attacks and run arbitrary Javascript in the browser of other CVE-2024-364995.5Vulnerability of unauthorized screenshot capturing in the WMS module Impact: Successful exploitation of this vulnerability may affect servic CVE-2024-36505.4The ElementsKit Elementor addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Image Accordion widget in all ver CVE-2024-365005.5Privilege escalation vulnerability in the AMS module Impact: Successful exploitation of this vulnerability may affect service confidentialit CVE-2024-365015.5Memory management vulnerability in the boottime module Impact: Successful exploitation of this vulnerability can affect integrity.CVE-2024-365025.5Out-of-bounds read vulnerability in the audio module Impact: Successful exploitation of this vulnerability will affect availability.CVE-2024-365035.5Memory management vulnerability in the Gralloc module Impact: Successful exploitation of this vulnerability will affect availability.CVE-2024-365046.5An out-of-bounds read vulnerability [CWE-125] in FortiOS SSLVPN web portal versions 7.4.0 through 7.4.4, versions 7.2.0 through 7.2.8, 7.0 a CVE-2024-365055.5An improper access control vulnerability [CWE-284] in FortiOS 7.4.0 through 7.4.3, 7.2.5 through 7.2.7, 7.0.12 through 7.0.14 and 6.4.x may CVE-2024-365065.3An improper verification of source of a communication channel vulnerability [CWE-940] in FortiClientEMS 7.4.0, 7.2.0 through 7.2.4, 7.0 all CVE-2024-365077.8A untrusted search path in Fortinet FortiClientWindows versions 7.4.0, versions 7.2.4 through 7.2.0, versions 7.0.12 through 7.0.0 allows an