Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.9

Norton Identity Safe can let attackers gain higher access

CVE-2018-12240 · published 8 years ago
Summary

Versions of Norton Identity Safe before 5.3.0.976 contain a weakness that could let a malicious user increase their privileges on the system. This could allow them to read encrypted passwords without proper authentication. Update to the latest version as soon as possible to close the gap.

What to do
  • Update symantec norton_password_manager to version 5.3.0.976 or later.
Affected software
VendorProductAffected versions
symantec norton_password_manager < 5.3.0.976
cpe:2.3:a:symantec:norton_password_manager:*:*:*:*:*:android:*:*
Original advisory text
The Norton Identity Safe product prior to 5.3.0.976 may be susceptible to a privilege escalation issue via a hard coded IV, which is a type of vulnerability that can potentially increase the likeli...
The Norton Identity Safe product prior to 5.3.0.976 may be susceptible to a privilege escalation issue via a hard coded IV, which is a type of vulnerability that can potentially increase the likelihood of encrypted data being recovered without adequate credentials.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
5.9 Medium
Exploitation
1% chance of attack within 30 days
Type
CWE-798Use of Hard-coded Credentials
Timeline
Published29 Aug 2018
Updated3 Nov 2026
First seen29 Sep 2026
Sources
CVE-2018-12240 · NVD
Track software like this
Free during beta