CVE-2022-4312
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk2th percentile - higher than 2% of all known CVEs
Summary
A cleartext storage of sensitive information vulnerability exists in PcVue versions 8.10 through 15.2.3. An unauthorized user with access to email and SMS account configuration files could discover SMTP account credentials and the SIM card PIN code.
Risk Assessment
The risk is that an attacker could gain access to the underlying email account and SIM card, potentially compromising communication confidentiality and enabling further attacks on the organization's infrastructure.
Recommendation
Immediately update PcVue to version 15.2.4 or later, which fixes this vulnerability. Additionally, restrict access to configuration files and encrypt sensitive data.
Original NVD description (English source)
A cleartext storage of sensitive information vulnerability exists in PcVue versions 8.10 through 15.2.3. This could allow an unauthorized user with access the email and short messaging service (SMS) accounts configuration files to discover the associated simple mail transfer protocol (SMTP) account credentials and the SIM card PIN code. Successful exploitation of this vulnerability could allow an unauthorized user access to the underlying email account and SIM card.