title: Hardcoded encryption key IV in Exago WebReportsApi.dll
description: Use of Hard-coded Cryptographic Key vulnerability in the WebReportsApi.dll of Exago Web Reports, as used in the Device42 Asset Management Appliance, allows an attacker to leak session IDs and elevate privileges. This issue affects: Device42 CMDB versions prior to 18.01.00.
problem types: CWE-321 Use of Hard-coded Cryptographic Key
affected:
{
product: CMDB
vendor: Device42
versions:
lessThan: 18.01.00, status: affected, version: unspecified, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: HIGH
attackVector: ADJACENT_NETWORK
availabilityImpact: LOW
baseScore: 7.1
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L
version: 3.1
]
solutions: An update to Device42 CMDB  version 19.01.00 fixes the issue.