Vulnerability · Published Dec 21, 2020 · Assigned by mitre
CVE-2020-8995
Critical 9.8
In plain English
A critical-severity security flaw in the affected software. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.2% (higher than 82% of all known vulnerabilities).
Severity (CVSS NVD)9.8Critical
Exploit odds (30 days)2.2%top 17.7% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
Programi Bilanc Build 007 Release 014 31.01.2020 supplies a .exe file containing several hardcoded credentials to different servers that allow remote attackers to gain access to the complete infrastructure including the website, update server, and external issue tracking tools.
Affected products (as reported)
References
- FULLDISC: 20201218 Programi Bilanc - Build 007 Release 014 31.01.2020 - Broken encryption with guessable static encryption key [CVE-2020-8995] mailing-list, x_refsource_FULLDISC
- https://packetstormsecurity.com/files/160626/Programi-Bilanc-Build-007-Release-014-31.01.2020-Hardcoded-Credentials.html x_refsource_MISC