Easywork Enterprise Cleartext Memory Storage Vulnerability

A vulnerability exists in Easywork Enterprise version 2.1.3.354, allowing for cleartext storage of sensitive information in memory. After a failed activation attempt, the application retains valid device-bound license keys in process memory. These keys can be extracted using a debugger or by analyzing a process or memory dump. Once obtained, the keys can be used to activate the software on the same machine without payment.

Impact

Exploitation of this vulnerability could lead to unauthorized software activation using extracted license keys.