CVE-2025-58740
Hard-Coded Key in Milner ImageDirector Capture Enables Credential Decryption
Publication date: 2026-01-20
Last updated on: 2026-02-10
Assigner: Security Risk Advisors
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| milner | imagedirector_capture | From 7.0.9 (inc) to 7.6.3.25808 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-321 | The product uses a hard-coded, unchangeable cryptographic key. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability involves the use of a hard-coded encryption key within the Password function in the C2SGlobalSettings.dll component of Milner ImageDirector Capture on Windows. Because the encryption key is embedded directly in the executable, a local attacker can extract this key and use it to decrypt database credentials, compromising the security of sensitive information.
How can this vulnerability impact me? :
The vulnerability allows a local attacker to decrypt database credentials by extracting the hard-coded cryptographic key from the executable. This can lead to unauthorized access to the database, potentially exposing sensitive data, enabling further attacks, and compromising the integrity and confidentiality of the system.