CVE-2016-10102

Published: Jan 23, 2017Modified: May 13, 2026

8.1

Vector

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 2.2 / Impact: 5.9

Source: NVD

Description

hitek.jar in Hitek Software's Automize uses weak encryption when encrypting SSH/SFTP and Encryption profile passwords. This allows an attacker to retrieve the encrypted passwords from sshProfiles.jsd and encryptionProfiles.jsd and decrypt them to recover cleartext passwords. All 10.x up to and including 10.25 and all 11.x up to and including 11.14 are verified to be affected.

Affected (39)

Products: Hiteksoftware: Automize

Hiteksoftware

1 product

Automize

Configuration A

39 vulnerable

Vulnerable Software	Affected Versions
Hiteksoftware Automize	Version 10.00
Hiteksoftware Automize	Version 10.01
Hiteksoftware Automize	Version 10.02
Hiteksoftware Automize	Version 10.03
Hiteksoftware Automize	Version 10.04
Hiteksoftware Automize	Version 10.05
Hiteksoftware Automize	Version 10.06
Hiteksoftware Automize	Version 10.07
Hiteksoftware Automize	Version 10.08
Hiteksoftware Automize	Version 10.09
Hiteksoftware Automize	Version 10.11
Hiteksoftware Automize	Version 10.12
Hiteksoftware Automize	Version 10.13
Hiteksoftware Automize	Version 10.14
Hiteksoftware Automize	Version 10.15
Hiteksoftware Automize	Version 10.16
Hiteksoftware Automize	Version 10.17
Hiteksoftware Automize	Version 10.18
Hiteksoftware Automize	Version 10.19
Hiteksoftware Automize	Version 10.20
Hiteksoftware Automize	Version 10.21
Hiteksoftware Automize	Version 10.22
Hiteksoftware Automize	Version 10.23
Hiteksoftware Automize	Version 10.24
Hiteksoftware Automize	Version 10.25
Hiteksoftware Automize	Version 11.00
Hiteksoftware Automize	Version 11.01
Hiteksoftware Automize	Version 11.02
Hiteksoftware Automize	Version 11.03
Hiteksoftware Automize	Version 11.04
Hiteksoftware Automize	Version 11.05
Hiteksoftware Automize	Version 11.06
Hiteksoftware Automize	Version 11.07
Hiteksoftware Automize	Version 11.08
Hiteksoftware Automize	Version 11.09
Hiteksoftware Automize	Version 11.11
Hiteksoftware Automize	Version 11.12
Hiteksoftware Automize	Version 11.13
Hiteksoftware Automize	Version 11.14

Related CWEs

CWE-326

Inadequate Encryption Strength

The product stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required.

References (4)

http://www.securityfocus.com/bid/96848

Source: cve@mitre.org

https://rastamouse.me/guff/2016/automize/

Source: cve@mitre.org

Third Party Advisory

http://www.securityfocus.com/bid/96848

Source: af854a3a-2127-422b-91ae-364da2661108

https://rastamouse.me/guff/2016/automize/

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

Timeline

No history available yet.