Cellebrite UFED Physical Device up to 7.5.0.845 hard-coded credentials

Summaryinfo

A vulnerability, which was classified as critical, was found in Cellebrite UFED Physical Device up to 7.5.0.845. Affected by this issue is some unknown functionality. The manipulation results in hard-coded credentials. This vulnerability was named CVE-2020-14474. The attack may be performed from remote. There is no available exploit.

Detailsinfo

A vulnerability was found in Cellebrite UFED Physical Device up to 7.5.0.845. It has been classified as critical. Affected is some unknown functionality. The manipulation with an unknown input leads to a hard-coded credentials vulnerability. CWE is classifying the issue as CWE-798. The product contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data. This is going to have an impact on confidentiality. CVE summarizes:

The Cellebrite UFED physical device 5.0 through 7.5.0.845 relies on key material hardcoded within both the executable code supporting the decryption process, and within the encrypted files themselves by using a key enveloping technique. The recovered key material is the same for every device running the same version of the software, and does not appear to be changed with each new build. It is possible to reconstruct the decryption process using the hardcoded key material and obtain easy access to otherwise protected data.

The weakness was presented 06/30/2020. This vulnerability is traded as CVE-2020-14474 since 06/19/2020. The exploitability is told to be easy. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1110.001.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Vendor

• Cellebrite

Name

• UFED Physical Device

Version

• 7.5.0.845

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion