Skip to content

CVE-2005-0809 NotifyLink, when configured for client key retrieval, allows remote attackers to obtain AES keys via a direct request to /hwp/get.asp, then uses a weak encryption scheme (fixed byte reordering) to pro...

HighCVSS 7.5 EPSS 1.2%
Published
Updated
Exploit status
No public exploit known
Sign in for asset impact Search another CVE

Description

NotifyLink, when configured for client key retrieval, allows remote attackers to obtain AES keys via a direct request to /hwp/get.asp, then uses a weak encryption scheme (fixed byte reordering) to protect the key, which allows remote attackers to obtain the key via a brute force attack.

Affected products

ProductAffected versionsFixed in
notify technology notifylink = enterprise_server No fix listed

References

  • 14617 third-party-advisory
  • VU#581068 third-party-advisory us-government-resource
  • 12843 vdb-entry