Medium severity5.3NVD Advisory· Published Aug 22, 2024· Updated Jun 17, 2026
CVE-2024-45165
CVE-2024-45165
Description
An issue was discovered in UCI IDOL 2 (aka uciIDOL or IDOL2) through 2.12. Data is sent between client and server with encryption. However, the key is derived from the string "(c)2007 UCI Software GmbH B.Boll" (without quotes). The key is both static and hardcoded. With access to messages, this results in message decryption and encryption by an attacker. Thus, it enables passive and active man-in-the-middle attacks.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
5- UCI Software GmbH/IDOL 2description
- Range: <=2.12
- Range: <=2.12
- Range: <=2.12
Patches
Vulnerability mechanics
References
5- www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2024-048.txtnvdThird Party Advisory
- download.uci.de/idol2/idol2Client_2_12.exenvdBroken Link
- uci.de/download/idol2-client.htmlnvdProductRelease Notes
- uci.de/products/index.htmlnvdProduct
- www.syss.de/en/responsible-disclosure-policynvdIssue Tracking
News mentions
0No linked articles in our index yet.