CVE-1999-1354 in FirstClass Internet Server
Summary
by MITRE
E-mail client in Softarc FirstClass Internet Server 5.506 and earlier stores usernames and passwords in cleartext in the files (1) home.fc for version 5.506, (2) network.fc for version 3.5, or (3) FCCLIENT.LOG when logging is enabled.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 04/19/2026
This vulnerability involves a critical security flaw in the Softarc FirstClass Internet Server email client software where authentication credentials are stored in plaintext format within specific configuration files. The vulnerability affects multiple versions of the software including 5.506 and earlier releases, as well as version 3.5, making it a widespread issue across different product iterations. The affected files include home.fc, network.fc, and FCCLIENT.LOG, which are all susceptible to unauthorized access and credential theft.
The technical implementation flaw stems from the application's insecure storage practices where user authentication information is written to disk without any form of encryption or obfuscation. This cleartext storage approach directly violates fundamental security principles and creates an immediate privilege escalation vector for attackers who gain access to the system. The vulnerability represents a classic example of weak credential storage mechanisms that aligns with CWE-312, which specifically addresses the exposure of sensitive information through cleartext storage of credentials. The flaw is particularly dangerous because it allows attackers to obtain valid login credentials without needing to perform additional exploitation techniques such as brute force attacks or social engineering.
The operational impact of this vulnerability is severe and multifaceted, as it provides attackers with immediate access to legitimate user accounts and potentially administrative privileges. Once an attacker gains access to the affected system, they can extract usernames and passwords from the plaintext files and use these credentials to authenticate to the email server and potentially other systems within the network. This vulnerability can be exploited through various attack vectors including local file system access, network-based attacks, or through compromise of system administrators who have access to these files. The impact extends beyond simple unauthorized access as it can enable further attacks such as lateral movement, data exfiltration, and privilege escalation within the network infrastructure.
The security implications of this vulnerability align with several ATT&CK framework techniques including credential access through file system access and credential dumping. The flaw creates a persistent threat vector that remains active as long as the vulnerable software remains installed and the configuration files contain cleartext credentials. Organizations should immediately implement mitigations including upgrading to patched versions of the software, implementing proper file system permissions, and conducting thorough security audits to identify and remove any cleartext credential files. Additionally, system administrators should consider implementing network segmentation and monitoring to detect unauthorized access attempts to these specific configuration files. The vulnerability demonstrates the critical importance of secure credential storage practices and highlights the need for regular security assessments to identify similar insecure storage mechanisms within enterprise applications.