Arqit Symmetric Key Agreement Platform QKEY Exposure Vulnerability

A vulnerability in the Arqit Symmetric Key Agreement Platform prior to version 26.03 allows for the unauthenticated and unencrypted exposure of the QKEY used in the 'OTA-Quantum' device registration process, as well as internal system keys. This exposure occurs through a REST API that can be accessed via an HTTP GET method, enabling network attackers to retrieve sensitive cryptographic keys from the platform's database.

Impact

Exploitation of this vulnerability allows network attackers to access and retrieve sensitive cryptographic keys, including the QKEY used for device registration, from the platform's database. This could potentially lead to unauthorized access or manipulation of cryptographic processes or data.

Remediation

Users can upgrade to Arqit Symmetric Key Agreement Platform version 26.03 or later to address this vulnerability.