Unscored severity · published Mar 23, 2004
CVE-2004-1852
DameWare Mini Remote Control 3.x before 3.74 and 4.x before 4.2 transmits the Blowfish encryption key in plaintext, which allows remote attackers to gain sensitive information
–
CVSS
0.8%
EPSS
No
On KEV
Description
DameWare Mini Remote Control 3.x before 3.74 and 4.x before 4.2 transmits the Blowfish encryption key in plaintext, which allows remote attackers to gain sensitive information.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 58% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DM
Dameware Mini Remote Control · Solarwinds
3.0 before 3.74; 4.0 before 4.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2004-1852
CVE.org
https://www.cve.org/CVERecord?id=CVE-2004-1852
Mailing List
http://marc.info/?l=bugtraq&m=108016344224973&w=2
Broken Link
http://secunia.com/advisories/11205
Broken Link
http://securitytracker.com/id?1009557
Product
http://www.dameware.com/support/security/bulletin.asp?ID=SB3
Broken Link
http://www.osvdb.org/4547
Broken Link
http://www.securityfocus.com/bid/9959
More from Dameware Mini Remote Control
9.8
CVE-2019-3980
The Solarwinds Dameware Mini Remote Client agent v12.1.0.89 supports smart card authentication which can allow a user to upload an executable to be executed on the DWRCS.exe host
9.1
CVE-2021-31217
In SolarWinds DameWare Mini Remote Control Server 12.0.1.200, insecure file permissions allow file deletion as SYSTEM
7.8
CVE-2018-12897
SolarWinds DameWare Mini Remote Control before 12.1 has a Buffer Overflow
7.5
CVE-2019-9017
DWRCC in SolarWinds DameWare Mini Remote Control 10.0 x64 has a Buffer Overflow associated with the size field for the machine name
7.4
CVE-2019-3957
Dameware Remote Mini Control version 12.1.0.34 and prior contains an unauthenticated remote buffer over-read due to the server not properly validating RsaSignatureLen during key…