What’s Vulnerable › Vulnerabilities

CVE-2023-39421: Use of Hard-coded Credentials in RDPWin.dll

• Severity: high (CVSS 7.7 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-09-07 · updated 2026-06-17
• Weakness: CWE-798

Description

The RDPWin.dll component as used in the IRM Next Generation booking engine includes a set of hardcoded API keys for third-party services such as Twilio and Vonage. These keys allow unrestricted interaction with these services.

Affected products

• Resort Data Processing, Inc. IRM Next Generation: 5.4.1.23

References

• https://bitdefender.com/blog/labs/check-out-with-extra-charges-vulnerabilities-in-hotel-booking-engine-explained
• https://bitdefender.com/blog/labs/check-out-with-extra-charges-vulnerabilities-in-hotel-booking-engine-explained

Get alerted when CVE-2023-39421 or the next vulnerability affects your stack