title: Weintek EasyBuilder Pro Use of Hard-coded Credentials
description:
Weintek EasyBuilder Pro contains a vulnerability that, even when the private key is immediately deleted after the crash report transmission is finished, the private key is exposed to the public, which could result in obtaining remote control of the crash report server.
problem types: CWE-798 Use of Hard-coded Credentials
affected:
{
defaultStatus: unaffected
product: EasyBuilder Pro
vendor: Weintek
versions:
lessThan: v6.07.02, status: affected, version: 0, versionType: custom
lessThanOrEqual: 6.08.01.592, status: affected, version: 0, versionType: custom
lessThanOrEqual: 6.08.02.470, status: affected, version: 0, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
]
format: CVSS
scenarios: GENERAL
solutions:
Weintek recommends users apply the following mitigations:
*  Update EasyBuilder Pro to  v6.08.01.614 https://www.weintek.com/globalw/Download/Download.aspx
*  Update EasyBuilder Pro to  v6.08.02.500 https://www.weintek.com/globalw/Download/Download.aspx