CVE-2018-18466

    Dashboard / Vulnerabilities / CVE-2018-18466

    CVE-2018-18466

    Published: 21 Mar 2019Last Modified: 10 Mar 2026

    Summary:

    Details: An issue was discovered in SecurEnvoy SecurAccess 9.3.502. When put in Debug mode and used for RDP connections, the application stores the emergency credentials in cleartext in the logs (present in the DEBUG folder) that can be accessed by anyone. NOTE: The vendor disputes this as a vulnerability since the disclosure of a local account password (actually an alpha numeric passcode) is achievable only when a custom registry key is added to the windows registry. This action requires administrator access and the registry key is only provided by support staff at securenvoy to troubleshoot customer issues.

    References: https://cds.thalesgroup.com/en/tcs-cert/CVE-2018-18466, , https://www.excellium-services.com/cert-xlm-advisory, https://www.excellium-services.com/cert-xlm-advisory/cve-2018-18466/

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High