CVEvulnerability
CVE-2022-34906
7.5 HIGH
Official page ↗
- Status
- Modified
- Published
- 2022-07-25
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- Weaknesses
- CWE-798
Description
A hard-coded cryptographic key is used in FileWave before 14.6.3 and 14.7.x before 14.7.2. Exploitation could allow an unauthenticated actor to decrypt sensitive information saved in FileWave, and even send crafted requests.
Affected configurations
• filewave filewave (< 14.6.3)
• filewave filewave (>= 14.7.0 < 14.7.2)
Related
Weakness · CWE (1)
- CWE-798 Use of Hard-coded Credentials weakness
References
- https://claroty.com/2022/07/25/blog-research-with-management-comes-risk-finding-flaws-in-filewave-mdm/ Exploit, Third Party Advisory
- https://kb.filewave.com/pages/viewpage.action?pageId=55544244 Release Notes, Third Party Advisory
- https://claroty.com/2022/07/25/blog-research-with-management-comes-risk-finding-flaws-in-filewave-mdm/ Exploit, Third Party Advisory
- https://kb.filewave.com/pages/viewpage.action?pageId=55544244 Release Notes, Third Party Advisory