Rocket Remote Desktop Credentials Exposure

Executive Summary

CVE-2026-78835 is a vulnerability in Rocket Software's Rocket Remote Desktop 18.0.8583.1 where user credentials are stored insecurely. The software saves credentials in a configuration file called environments.xml with passwords encrypted using a static AES key. Additionally, user credentials are encrypted with either the user's SID or password as the key and IV. Attackers with system access can decrypt these credentials using routines from CommonHelper.dll and vSIT2.dll.

Useful 0 Not Useful 0

Detection Guidance

Check for the presence of the environments.xml file in Rocket Remote Desktop's configuration directory. Inspect the file for credentials encrypted with a static AES key. Use tools like strings or a hex editor to analyze CommonHelper.dll and vSIT2.dll for decryption routines.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers with access to a system running Rocket Remote Desktop to decrypt and view all stored user credentials, not just the current user's. This could lead to unauthorized access to sensitive accounts and data, especially in environments where low-privileged users can access high-privileged accounts. The risk is higher if multiple users share the same system.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to non-compliance with GDPR, HIPAA, and other regulations that require protection of sensitive user data. Unauthorized access to credentials may result in data breaches, violating privacy and security requirements. Organizations using Rocket Remote Desktop may face legal and regulatory penalties for failing to safeguard user credentials.

Useful 0 Not Useful 0

Mitigation Strategies

Restrict access to the environments.xml file and Rocket Remote Desktop installation directory. Monitor for unauthorized access to these files. Consider temporarily disabling credential storage in Rocket Remote Desktop until a patch is released.

Useful 0 Not Useful 0