CVE-2020-14474

An attacker with access to a Cellebrite UFED device (or its software distribution) can extract the hardcoded AES key material from the `FileUnpacking.dll` binary using the provided `extract-keys` script. The same key material is shared across all devices running the same software version and does not change between builds [ref_id=1]. With the recovered keys, the attacker can decrypt any EPR file (e.g., `Android.zip.epr`) produced by that version of the software, gaining access to the otherwise protected extracted mobile-device data [CWE-321]. No network access or authentication bypass is required; the attacker only needs the binary and the encrypted EPR files.

The vulnerability resides in the `FileUnpacking.dll` binary that ships with Cellebrite UFED Physical device versions 5.0 through 7.5.0.845. The DLL contains hardcoded AES key material used to decrypt EPR (encrypted package) files. The advisory demonstrates that key material can be extracted from this DLL by scanning for known SHA256 hash patterns across DWORD-aligned offsets [ref_id=1].

The advisory does not describe a vendor patch or provide a fix. It recommends that Cellebrite stop relying on a single, hardcoded key shared across all devices and instead use a key-management scheme where each device or each extraction session derives unique key material [ref_id=1]. Without such a change, any party who obtains a copy of the `FileUnpacking.dll` can decrypt all EPR files created by that software version.

The advisory provides a proof-of-concept workflow. First, run the `extract-keys` script on the `FileUnpacking.dll` binary to recover the hardcoded AES key material. The script iterates over DWORD-aligned offsets in the DLL, computes SHA256 hashes, and compares them against known patterns to extract the keys. Then use the `decrypt-epr` tool with the recovered keys to decrypt any EPR file (e.g., `Android.zip.epr`). A `Makefile` is provided to automate both steps [ref_id=1].