CVE-2024-45165

MEDIUM EPSS 7.1%
Published Aug 22, 20241y ago · Modified Jun 17, 20262w ago
5.3 CVSS 3.1
Medium
Find Similar
Published Aug 22, 2024 1y ago
Last Modified Jun 17, 2026 2w ago

Description

An issue was discovered in UCI IDOL 2 (aka uciIDOL or IDOL2) through 2.12. Data is sent between client and server with encryption. However, the key is derived from the string "(c)2007 UCI Software GmbH B.Boll" (without quotes). The key is both static and hardcoded. With access to messages, this results in message decryption and encryption by an attacker. Thus, it enables passive and active man-in-the-middle attacks.

CVSS Details

Base Score
5.3
Exploitability
1.6
Impact
3.6
Vector string
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack Vector Adjacent
Attack Complexity High
Privileges Required None
User Interaction None
Scope Unchanged
Confidentiality High
Integrity None
Availability None

Threat Intelligence

EPSS Exploit Probability
7.1% percentile
Exploit & Patch Status
No Known Exploit
No Patch Available

Weaknesses 1

CWE-798 Use of Hard-coded Credentials Authentication

Affected Products 1

VendorProductVersionRange
uciidol2* ≤2.12

References 5

  • download.uci.de http://download.uci.de/idol2/idol2Client_2_12.exe
    Broken Link
  • uci.de https://uci.de/download/idol2-client.html
    ProductRelease Notes
  • uci.de https://uci.de/products/index.html
    Product
  • syss.de https://www.syss.de/en/responsible-disclosure-policy
    Issue Tracking
  • syss.de https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2024-048.txt
    Third Party Advisory

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.