Ivanti Workspace Control Hardcoded Key Vulnerability Allowing Decryption of Environment Passwords

A vulnerability exists in Ivanti Workspace Control versions prior to 10.19.10.0, where a hardcoded key allows local authenticated attackers to decrypt stored environment passwords. This vulnerability could lead to unauthorized access to sensitive information by exploiting the decryption capability.

Impact

Exploitation of this vulnerability could result in the unauthorized decryption of environment passwords, potentially leading to credential compromise.

Remediation

Users can upgrade to Ivanti Workspace Control 2025.2 (10.19.x.x), which addresses these security issues. Instructions for migrating to the new IWC architecture are available in the Ivanti Workspace Control 2025.2 Migration Guide. Before installing the agent, relay-server, or Console component, the TLS certificate used by the ShieldAPI should be trusted by importing it to the Trusted Root Certificates Authorities for the Local Machine.