Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Vulnerability Description
NotifyLink, when configured for client key retrieval, allows remote attackers to obtain AES keys via a direct request to /hwp/get.asp, then uses a weak encryption scheme (fixed byte reordering) to protect the key, which allows remote attackers to obtain the key via a brute force attack.
CVSS Information
N/A
Vulnerability Type
N/A
Vulnerability Title
NotifyLink Enterprise Server多个弱口令漏洞
Vulnerability Description
当NotifyLink配置为客户端密钥检索时，允许远程攻击者通过对/hwp/get.asp的直接请求来获取AES密钥，然后使用较弱的加密方案(固定字节重排)来保护密钥，从而远程攻击者可以通过暴力破解的方法来获取密钥。
CVSS Information
N/A
Vulnerability Type
N/A