CyberRota Analysis
This is a critical severity vulnerability with a CVSS score of 9.9. It may be remotely exploitable.
CVE
CVE-2023-39420
Severity
CRITICAL
CVSS
9.9
EPSS
0.55%
Original NVD Description
The RDPCore.dll component as used in the IRM Next Generation booking engine, allows a remote user to connect to customers with an "admin" account and a corresponding password computed daily by a routine inside the DLL file. Once reverse-engineered, this routine can help an attacker generate the daily password and connect to application customers. Given that this is an administrative account, anyone logging into a customer deployment has full, unrestricted access to the application.
Related CVEs
Other vulnerabilities affecting the same vendor(s)