Vulnerability · Published Sep 7, 2023 · Assigned by Bitdefender
CVE-2023-39421Use of Hard-coded Credentials in RDPWin.dll
High 7.7
In plain English
A high-severity hard-coded credentials in IRM Next Generation from Resort Data Processing, Inc.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 41% of all known vulnerabilities).
Severity (CVSS 3.1)7.7High
Exploit odds (30 days)0.5%top 58.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
The RDPWin.dll component as used in the IRM Next Generation booking engine includes a set of hardcoded API keys for third-party services such as Twilio and Vonage. These keys allow unrestricted interaction with these services.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Resort Data Processing, Inc. | IRM Next Generation | 5.4.1.23 |
Weakness: CWE-798 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N