CVE-2023-43637

Summary

CVE-2023-43637: A vulnerability was discovered in the "deriveVaultKey" function, affecting versions prior to 7.10. The issue arises from the function's implementation, which combines a predetermined key ("foobarfoobarfoobarfoobarfoobarfo") with the randomly generated key. This merge results in a significantly weaker vault key. Devices initialized before version 7.10 and updated to newer versions remain affected. An update is recommended to enforce full usage of the randomly generated 32-byte key.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.