Vulnerability · Published Nov 5, 2020 · Assigned by mitre
CVE-2020-27688
High 7.5
In plain English
A high-severity security flaw in the affected software. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.9% (higher than 80% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.
Severity (CVSS NVD)7.5High
Exploit odds (30 days)1.9%top 20.0% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack tooling1Public PoC
Official description
RVToolsPasswordEncryption.exe in RVTools 4.0.6 allows users to encrypt passwords to be used in the configuration files. This encryption used a static IV and key, and thus using the Decrypt() method from VISKD.cs from the RVTools.exe executable allows for decrypting the encrypted passwords. The accounts used in the configuration files have access to vSphere instances.
Affected products (as reported)
References
- https://www.robware.net/rvtools/ x_refsource_MISC
- https://github.com/matthiasmaes/CVE-2020-27688 x_refsource_MISC