CVE-2023-3395
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk17th percentile - higher than 17% of all known CVEs
Summary
All versions of the TWinSoft Configuration Tool store encrypted passwords as plaintext in memory. An attacker with access to system files could open a file to load the document into memory, including sensitive information associated with the document, such as the password.
Risk Assessment
An attacker could obtain plaintext passwords, posing a serious threat to the organization's data security.
Recommendation
It is recommended to update the TWinSoft tool to the latest version and implement additional measures to protect data in memory.
Original NVD description (English source)
All versions of the TWinSoft Configuration Tool store encrypted passwords as plaintext in memory. An attacker with access to system files could open a file to load the document into memory, including sensitive information associated with document, such as password. The attacker could then obtain the plaintext password by using a memory viewer.