Unprotected storage of credentials in MDLC - CVE-2022-30275
Published: June 29, 2022
Vulnerability identifier: #VU64792
CSH Severity: Medium
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green
CVE-ID: CVE-2022-30275
CWE-ID: CWE-256
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerable software:
MDLC
MDLC
Software vendor:
Motorola
Motorola
Description
The vulnerability allows a remote attacker to gain access to other users' credentials.
The vulnerability exists due to the affected product utilizes an MDLC driver that has a password stored in plaintext in the wmdlcdrv.ini driver configuration file. A remote attacker can view contents of the configuration file and gain access to passwords for 3rd party integration.
Remediation
Cybersecurity Help is currently unaware of any official solution to address this vulnerability.