by Kastro
Paper/Archive/CVE-2023-37286

CVE-2023-37286

SamrtSoft SmartBPM.NET — SmartBPM.NET - Use of Hard-Coded Credentials - 1

EPSS 1%CVSS 9.8
critical.is priorityof 100
42
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 63.0.630 × 2012.6No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

SmartSoft SmartBPM.NET has a vulnerability of using hard-coded machine key. An unauthenticated remote attacker can use the machine key to send serialized payload to the server to execute arbitrary code and disrupt service.

Affected

ProductAffectedFixed inSource
SmartBPM.NET6.70–CNA

Scores by source

twcert (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

reftwcert.org.tw/tw/cp-132-7221-438c6-1.html