CVE-2024-42012

—

CVSS 3.1

5.7 medium

EPSS

<1%p4

Published

Jan 22, 2025 (Jan 22, 2025)

Modified

Jun 17, 2026

Description

GRAU DATA Blocky before 3.1 stores passwords encrypted rather than hashed. At the login screen, the user's password is compared to the user's decrypted cleartext password. An attacker with Windows admin or debugging rights can therefore steal the user's Blocky password and from there impersonate that local user.

Weakness: CWE-522
Vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N

NVD CVE.org GitHub PoCs EPSS (0.1%)

In the news0 stories

No ingested article mentions this CVE yet.