ConnectWise Risk Assessment Hardcoded AES Decryption Key Extraction Vulnerability

A vulnerability exists in the ConnectWise Password Encryption Utility within ConnectWise Risk Assessment. It allows an attacker to extract a hardcoded AES decryption key through reverse engineering. This key, embedded in plaintext in the binary, is used in cryptographic operations without proper key management. Once extracted, the key can decrypt CSV files used for authenticated network scanning.

Impact

Exploitation of this vulnerability allows for the extraction of a decryption key, which can be used to decrypt sensitive CSV input files related to network scanning.