Acclaim Systems USAHERDS Use of Hard-Coded Credentials Vulnerability

[ Why it matters ]Priority signals

• Exploited in the wild: on CISA's Known Exploited Vulnerabilities list since 2024-12-23
• EPSS: 18% chance of exploitation in the next 30 days (higher than 97% of CVEs)

[ Description ]Official description

Acclaim USAHERDS through 7.4.0.1 uses hard-coded credentials.

CISA: Acclaim Systems USAHERDS contains a hard-coded credentials vulnerability that could allow an attacker to achieve remote code execution on the system that runs the application. The MachineKey must be obtained via a separate vulnerability or other channel.

[ Fixes ]Fixes and patches

CISA required action (US federal deadline 13 Jan 2025): Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Please contact the product developer for support and vulnerability mitigation.

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ References ]References

• github.com/mandiant/Vulnerability-Disclosures/blob/master/MNDT-2021-0012/MNDT-2021-0012.mdThird Party Advisory
• www.acclaimsystems.comVendor Advisory
• www.cisa.gov/known-exploited-vulnerabilities-catalogUS Government Resource