CVE-2026-39031 Details
Description
Lansweeper lsrunase 2.0 and lsencrypt 2.0 use RC4 encryption with a hardcoded 142-byte static key array to encrypt credentials. An 8-character prefix is stored in cleartext alongside the ciphertext. This allows an attacker with local access to recover any encrypted password to plaintext using a single SHA-1 hash and RC4 decryption operation, with no brute force required.
A vulnerability exists in Lansweeper lsrunase version 2.0 and lsencrypt version 2.0, where passwords are encrypted using RC4 with a hardcoded static key. An 8-character prefix is stored in cleartext with the ciphertext, enabling an attacker with local access to decrypt any encrypted password using a single SHA-1 hash and RC4 decryption, without the need for brute force.
Users are advised to discontinue the use of lsrunase 2.0 and lsencrypt 2.0 for password encryption, rotate all credentials encrypted by these tools, and replace the encryption scheme with a modern algorithm such as AES-256-GCM or a contemporary password hashing method like Argon2id, bcrypt, or scrypt.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 26, 2026CISA-ADP
Assessed Jun 29, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/user6400/cve-2026-39031-lansweeper-lsrunase2-lsencrypt2 | CISA-ADP | ExploitTechnical Description |
| https://usermode.net/cve/lansweeper_lsrunase2_lsencrypt2_cve.pdf | CISA-ADP | AdvisoryExploitRemedy |
| https://github.com/user6400/cve-2026-39031-lansweeper-lsrunase2-lsencrypt2 | [email protected] | ExploitTechnical Description |
| https://usermode.net/cve/lansweeper_lsrunase2_lsencrypt2_cve.pdf | [email protected] | AdvisoryExploitRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-321 | Use of Hard-coded Cryptographic Key | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| Lansweeper lsrunase | 2.0 |
CPE
Remediation
| |
| Lansweeper lsencrypt | 2.0 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 29, 2026 | CVE Modified | CISA-ADP |
| Jun 26, 2026 | New CVE Received | [email protected] |