CVE-2023-39421

Summary

CVE-2023-39421: A vulnerability has been identified in the RDPWin.dll component of IRM Next Generation booking engine. The issue lies in the presence of hardcoded API keys for third-party services Twilio and Vonage. An attacker who gains unauthorized access to the system can exploit these keys to interact unrestrictedly with these services, potentially leading to data breaches or unauthorized service usage. This vulnerability poses a significant risk to organizations using this software and emphasizes the importance of securely managing and protecting API keys.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.