CVE-2020-29063 : Security Advisory and Response

An issue was discovered on CDATA devices where a custom encryption algorithm is used to store encrypted passwords by XORing them with a hardcoded value.

Understanding CVE-2020-29063

What is CVE-2020-29063?

This CVE identifies a vulnerability in CDATA devices that use a custom encryption algorithm for storing passwords.

The Impact of CVE-2020-29063

The vulnerability allows potential attackers to potentially decrypt passwords stored on affected CDATA devices.

Technical Details of CVE-2020-29063

Vulnerability Description

The issue lies in the custom encryption algorithm used by CDATA devices to store passwords, which involves XORing passwords with a hardcoded value.

Affected Systems and Versions

CDATA 72408A, 9008A, 9016A, 92408A, 92416A, 9288, 97016, 97024P, 97028P, 97042P, 97084P, 97168P, FD1002S, FD1104, FD1104B, FD1104S, FD1104SN, FD1108S, FD1204S-R2, FD1204SN, FD1204SN-R2, FD1208S-R2, FD1216S-R1, FD1608GS, FD1608SN, FD1616GS, FD1616SN, and FD8000 devices.

Exploitation Mechanism

The vulnerability can be exploited by attackers to potentially decrypt passwords stored on the affected CDATA devices.

Mitigation and Prevention

Immediate Steps to Take

Implement strong, unique passwords for all accounts on CDATA devices.
Regularly monitor and audit password changes and access logs.

Long-Term Security Practices

Consider implementing multi-factor authentication for enhanced security.
Regularly update firmware and security patches provided by CDATA.
Conduct security assessments and penetration testing to identify and address vulnerabilities.

Patching and Updates

Apply patches and updates released by CDATA to address this vulnerability.