CVE-2020-14474

Katalog CVE

CVSS 7.5 · High EPSS 2,5%

Kerentanan Use of Hard-coded Credentials pada cellebrite ufed firmware. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

The Cellebrite UFED physical device 5.0 through 7.5.0.845 relies on key material hardcoded within both the executable code supporting the decryption process, and within the encrypted files themselves by using a key enveloping technique. The recovered key material is the same for every device running the same version of the software, and does not appear to be changed with each new build. It is possible to reconstruct the decryption process using the hardcoded key material and obtain easy access to otherwise protected data.

Rincian

Terbit di NVD

30 Juni 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-798: Use of Hard-coded Credentials

EPSS (30 hari)

2,5% peluang dieksploitasi; lebih tinggi dari 84,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• http://packetstormsecurity.com/files/158254/Cellebrite-EPR-Decryption-Hardcoded-AES-Key-Material.html exploit · advisory pihak ketiga · vdb entry
• http://seclists.org/fulldisclosure/2020/Jun/31 exploit · mailing list · advisory pihak ketiga
• https://korelogic.com/Resources/Advisories/KL-001-2020-003.txt exploit · advisory pihak ketiga