← CVE Intelligence

CVE-2023-42419

Improper Management of Cryptographic Keys in the Maintenance Server in QCOW Air-Gapped Distribution (China Edition) PUBLISHED

Description (CNA)

Maintenance Server, in Cybellum's QCOW air-gapped distribution (China Edition), versions 2.15.5 through 2.27, was compiled with a hard-coded private cryptographic key. An attacker with administrative privileges & access to the air-gapped server could potentially use this key to run commands on the server. The issue was resolved in version 2.28. Earlier versions, including all Cybellum 1.x versions, and distributions for the rest of the world remain unaffected.

Affected (CNA)

Vendor / productVersions
Cybellum / Maintenance Serveraffected 2.15.5 through 2.27; unaffected 1.*; unaffected 2.0 through 2.19; unaffected 2.28 through or above

CWE

No CWE identifiers supplied.

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.

CVE

No English description supplied.