CVE-2026-5310

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-5310", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-04-01T12:02:06.531Z", "datePublished": "2026-04-01T16:30:21.522Z", "dateUpdated": "2026-04-01T17:54:16.358Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-04-01T16:30:21.522Z"}, "title": "Enter Software Iperius Backup IperiusAccounts.ini hard-coded key", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-321", "lang": "en", "description": "Use of Hard-coded Cryptographic Key"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-320", "lang": "en", "description": "Key Management Error"}]}], "affected": [{"vendor": "Enter Software", "product": "Iperius Backup", "versions": [{"version": "8.7.0", "status": "affected"}, {"version": "8.7.1", "status": "affected"}, {"version": "8.7.2", "status": "affected"}, {"version": "8.7.4", "status": "unaffected"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability was identified in Enter Software Iperius Backup up to 8.7.2. This impacts an unknown function of the file IperiusAccounts.ini. Such manipulation leads to use of hard-coded cryptographic key\r . The attack must be carried out locally. This attack is characterized by high complexity. The exploitability is said to be difficult. The exploit is publicly available and might be used. Upgrading to version 8.7.4 will fix this issue. It is suggested to upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 2, "vectorString": "CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P", "baseSeverity": "LOW"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 2.5, "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C", "baseSeverity": "LOW"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 2.5, "vectorString": "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C", "baseSeverity": "LOW"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 1, "vectorString": "AV:L/AC:H/Au:S/C:P/I:N/A:N/E:POC/RL:OF/RC:C"}}], "timeline": [{"time": "2026-04-01T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-04-01T02:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-04-01T14:07:14.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "VulnaraByte (VulDB User)", "type": "reporter"}, {"lang": "en", "value": "VulDB", "type": "coordinator"}], "references": [{"url": "https://vuldb.com/vuln/354639", "name": "VDB-354639 | Enter Software Iperius Backup IperiusAccounts.ini hard-coded key", "tags": ["vdb-entry"]}, {"url": "https://vuldb.com/vuln/354639/cti", "name": "VDB-354639 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/submit/778602", "name": "Submit #778602 | Iperius Iperius Backup <= 8.7.2 Use of Hard-coded Cryptographic Key", "tags": ["third-party-advisory"]}, {"url": "https://github.com/VulnaraByte/iperius-backup-security-advisories", "tags": ["related"]}, {"url": "https://github.com/VulnaraByte/iperius-backup-security-advisories/blob/main/poc/decrypt_iperius.py", "tags": ["exploit"]}, {"url": "https://www.iperiusbackup.com/download-software-backup.aspx", "tags": ["patch"]}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-01T17:52:04.996671Z", "id": "CVE-2026-5310", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-01T17:54:16.358Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-5310", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-01T17:52:04.996671Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-01T17:52:09.307Z"}}], "cna": {"title": "Enter Software Iperius Backup IperiusAccounts.ini hard-coded key", "credits": [{"lang": "en", "type": "reporter", "value": "VulnaraByte (VulDB User)"}, {"lang": "en", "type": "coordinator", "value": "VulDB"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 2, "baseSeverity": "LOW", "vectorString": "CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 2.5, "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 2.5, "baseSeverity": "LOW", "vectorString": "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 1, "vectorString": "AV:L/AC:H/Au:S/C:P/I:N/A:N/E:POC/RL:OF/RC:C"}}], "affected": [{"vendor": "Enter Software", "product": "Iperius Backup", "versions": [{"status": "affected", "version": "8.7.0"}, {"status": "affected", "version": "8.7.1"}, {"status": "affected", "version": "8.7.2"}, {"status": "unaffected", "version": "8.7.4"}]}], "timeline": [{"lang": "en", "time": "2026-04-01T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-04-01T02:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-04-01T14:07:14.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/vuln/354639", "name": "VDB-354639 | Enter Software Iperius Backup IperiusAccounts.ini hard-coded key", "tags": ["vdb-entry"]}, {"url": "https://vuldb.com/vuln/354639/cti", "name": "VDB-354639 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/submit/778602", "name": "Submit #778602 | Iperius Iperius Backup <= 8.7.2 Use of Hard-coded Cryptographic Key", "tags": ["third-party-advisory"]}, {"url": "https://github.com/VulnaraByte/iperius-backup-security-advisories", "tags": ["related"]}, {"url": "https://github.com/VulnaraByte/iperius-backup-security-advisories/blob/main/poc/decrypt_iperius.py", "tags": ["exploit"]}, {"url": "https://www.iperiusbackup.com/download-software-backup.aspx", "tags": ["patch"]}], "descriptions": [{"lang": "en", "value": "A vulnerability was identified in Enter Software Iperius Backup up to 8.7.2. This impacts an unknown function of the file IperiusAccounts.ini. Such manipulation leads to use of hard-coded cryptographic key\r . The attack must be carried out locally. This attack is characterized by high complexity. The exploitability is said to be difficult. The exploit is publicly available and might be used. Upgrading to version 8.7.4 will fix this issue. It is suggested to upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-321", "description": "Use of Hard-coded Cryptographic Key"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-320", "description": "Key Management Error"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-04-01T16:30:21.522Z"}}}, "cveMetadata": {"cveId": "CVE-2026-5310", "state": "PUBLISHED", "dateUpdated": "2026-04-01T17:54:16.358Z", "dateReserved": "2026-04-01T12:02:06.531Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-04-01T16:30:21.522Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "Iperius Backup", "vendor": "Enter Software", "versions": [{"status": "affected", "version": "8.7.0"}, {"status": "affected", "version": "8.7.1"}, {"status": "affected", "version": "8.7.2"}, {"status": "unaffected", "version": "8.7.4"}]}], "source": "cna@vuldb.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability was identified in Enter Software Iperius Backup up to 8.7.2. This impacts an unknown function of the file IperiusAccounts.ini. Such manipulation leads to use of hard-coded cryptographic key\r . The attack must be carried out locally. This attack is characterized by high complexity. The exploitability is said to be difficult. The exploit is publicly available and might be used. Upgrading to version 8.7.4 will fix this issue. It is suggested to upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product."}, {"lang": "es", "value": "Una vulnerabilidad fue identificada en Enter Software Iperius Backup hasta la versi\u00f3n 8.7.2. Esto afecta una funci\u00f3n desconocida del archivo IperiusAccounts.ini. Dicha manipulaci\u00f3n conduce al uso de una clave criptogr\u00e1fica codificada de forma r\u00edgida. El ataque debe llevarse a cabo localmente. Este ataque se caracteriza por una alta complejidad. La explotabilidad se considera dif\u00edcil. El exploit est\u00e1 disponible p\u00fablicamente y podr\u00eda ser utilizado. La actualizaci\u00f3n a la versi\u00f3n 8.7.4 solucionar\u00e1 este problema. Se sugiere actualizar el componente afectado. El proveedor fue contactado con antelaci\u00f3n, respondi\u00f3 de manera muy profesional y lanz\u00f3 r\u00e1pidamente una versi\u00f3n corregida del producto afectado."}], "id": "CVE-2026-5310", "lastModified": "2026-10-26T21:10:00.170", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "LOW", "cvssData": {"accessComplexity": "HIGH", "accessVector": "LOCAL", "authentication": "SINGLE", "availabilityImpact": "NONE", "baseScore": 1.0, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:L/AC:H/Au:S/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 1.5, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 2.5, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.0, "impactScore": 1.4, "source": "cna@vuldb.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "HIGH", "attackRequirements": "NONE", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 1.1, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-5310", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-01T17:52:04.996671Z", "version": "2.0.3"}}]}, "published": "2026-04-01T17:28:43.313", "references": [{"source": "cna@vuldb.com", "url": "https://github.com/VulnaraByte/iperius-backup-security-advisories"}, {"source": "cna@vuldb.com", "url": "https://github.com/VulnaraByte/iperius-backup-security-advisories/blob/main/poc/decrypt_iperius.py"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/submit/778602"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/354639"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/354639/cti"}, {"source": "cna@vuldb.com", "url": "https://www.iperiusbackup.com/download-software-backup.aspx"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-320"}, {"lang": "en", "value": "CWE-321"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "8.7.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "8.7.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "8.7.2"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "8.7.4"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "Iperius Backup", "source": "cna", "vendor": "Enter Software"}, "product": "iperius_backup", "vendor": "enter_software"}], "analysis": {"en": {"generated_at": "2026-04-02T05:11:10.374179+00:00", "value": {"mitigation_remediation": ["Upgrade Enter Software Iperius Backup to version 8.7.4 or later."], "summary": {"action": "Patch Now", "impact": "Credential compromise via hard\u2011coded cryptographic key"}, "threat_synthesis": {"affected_systems": "All releases of Enter Software Iperius Backup up to and including version 8.7.2 are affected. The vendor has released a fixed version, 8.7.4, which removes the hard\u2011coded key and secures credential storage. Systems running an earlier version should be upgraded to 8.7.4 or later.", "description_and_impact": "Enter Software Iperius Backup stores a cryptographic key in the IperiusAccounts.ini file in a hard\u2011coded form. Manipulation of an unknown function of this file causes the application to use the fixed key, enabling an attacker to decrypt stored account credentials. This flaw is a classic example of insecure handling of cryptographic material, documented as CWE\u2011320 and CWE\u2011321.", "risk_and_exploitability": "The CVSS score of 2 reflects a low baseline severity, yet the vulnerability is publicly documented and exploit code is available, indicating a realistic threat for attackers who have local access. The attack requires local privileges to modify the IperiusAccounts.ini file and has a high complexity, making exploitation difficult but not impossible. The vulnerability is not recorded in the CISA KEV catalog, but the public availability of an exploit raises the likelihood of targeted or opportunistic attacks on unpatched installations."}}}}, "created": "2026-04-02T07:48:21.820649+00:00", "updated": "2026-04-02T20:17:14.312226+00:00", "vendors": ["enter_software", "enter_software$PRODUCT$iperius_backup"]}