What’s Vulnerable › Vulnerabilities

CVE-2018-18466

• Severity: high (CVSS 7.0 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2019-03-21 · updated 2026-06-17
• Weakness: CWE-532

Description

An issue was discovered in SecurEnvoy SecurAccess 9.3.502. When put in Debug mode and used for RDP connections, the application stores the emergency credentials in cleartext in the logs (present in the DEBUG folder) that can be accessed by anyone. NOTE: The vendor disputes this as a vulnerability since the disclosure of a local account password (actually an alpha numeric passcode) is achievable only when a custom registry key is added to the windows registry. This action requires administrator access and the registry key is only provided by support staff at securenvoy to troubleshoot customer issues.

Affected products

• SecurEnvoy SecurAccess: 9.3.502

References

• https://cds.thalesgroup.com/en/tcs-cert/CVE-2018-18466
• https://www.excellium-services.com/cert-xlm-advisory
• https://www.excellium-services.com/cert-xlm-advisory/cve-2018-18466/
• https://www.excellium-services.com/cert-xlm-advisory/cve-2018-18466/

Get alerted when CVE-2018-18466 or the next vulnerability affects your stack