« Volver al listado

CVE-2025-26849

Estado: AnalizadaMedia (4.3)—

There is a Hard-coded Cryptographic Key in Docusnap 13.0.1440.24261, and earlier and later versions. This key can be used to decrypt inventory files that contain sensitive information such as firewall rules.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Docusnap — Docusnap

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-26849",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-26849",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-03-04T15:42:28.087367Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "cve@mitre.org",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 4.3,
          "attackVector": "LOCAL",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 2.5
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "Docusnap",
          "product": "Docusnap",
          "versions": [
            {
              "status": "affected",
              "version": "13.0.1440.24261",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2025-03-04T09:15:10.917",
  "references": [
    {
      "url": "https://docs.docusnap.com/en/release-notes/changelog/",
      "tags": [
        "Release Notes"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://www.redteam-pentesting.de/en/advisories/rt-sa-2024-012/",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://www.redteam-pentesting.de/en/advisories/rt-sa-2024-012/",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "cve@mitre.org",
      "description": [
        {
          "lang": "en",
          "value": "CWE-1394"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "There is a Hard-coded Cryptographic Key in Docusnap 13.0.1440.24261, and earlier and later versions. This key can be used to decrypt inventory files that contain sensitive information such as firewall rules."
    },
    {
      "lang": "es",
      "value": "Hay una clave criptográfica codificada de forma rígida en Docusnap 13.0.1440.24261 y en versiones anteriores y posteriores. Esta clave se puede utilizar para descifrar archivos de inventario que contienen información confidencial, como reglas de firewall."
    }
  ],
  "lastModified": "2026-06-17T09:02:28.950",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:docusnap:docusnap:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FE2C3471-D450-4C32-AE8A-B9F802D48D9D",
              "versionEndIncluding": "13.0.1440.24261"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}