CVE-2021-31989 — Cleartext Storage of Sensitive Information in Memory in Device Manager

CWE-316 — Cleartext Storage of Sensitive Information in Memory CWE-312 — Cleartext Storage of Sensitive Info3 documents3 sources

Severity

5.3MEDIUMNVD

EPSS

0.1%

top 66.19%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Axis Device Manager Axis Communications AB Axis Device Manager

Timeline

PublishedAug 25

Latest updateMay 24

Description

A user with permission to log on to the machine hosting the AXIS Device Manager client could under certain conditions extract a memory dump from the built-in Windows Task Manager application. The memory dump may potentially contain credentials of connected Axis devices.

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:NExploitability: 1.6 | Impact: 3.6

Affected Packages2 packages

▶NVDaxis/device_manager5.00.010 — 5.16.063

▶CVEListV5axis_communications_ab/axis_device_managerFrom Axis Device Manager 5.00.010

🔴Vulnerability Details

GHSA

GHSA-cv8w-w978-3xww: A user with permission to log on to the machine hosting the AXIS Device Manager client could under certain conditions extract a memory dump from the b↗2022-05-24

▶

CVEList

CVE-2021-31989: A user with permission to log on to the machine hosting the AXIS Device Manager client could under certain conditions extract a memory dump from the b↗2021-08-25

▶