Calero VeraSMART Hardcoded AES Keys in Veramark.Framework.dll Allow Decryption of Service Credentials

In Calero VeraSMART versions prior to 2026 R1, hardcoded AES encryption keys are embedded within the Veramark.Framework.dll file, specifically in the Veramark.Core.Config class. These keys encrypt the passwords of service accounts stored in the application settings file. An attacker with local access can extract these keys, decrypt the credentials, and use them to authenticate to the Windows host. This could lead to local privilege escalation, depending on the rights associated with the service account.

Impact

Exploitation of this vulnerability allows for the decryption of service account passwords, which can be used to authenticate to the Windows host. This could result in local privilege escalation, depending on the privileges of the service account.