{"cve":"CVE-2018-18466","nvd":{"published":"2019-03-21T16:00:28.420","modified":"2026-06-17T01:47:21.013","status":"Modified","description":"An issue was discovered in SecurEnvoy SecurAccess 9.3.502. When put in Debug mode and used for RDP connections, the application stores the emergency credentials in cleartext in the logs (present in the DEBUG folder) that can be accessed by anyone. NOTE: The vendor disputes this as a vulnerability since the disclosure of a local account password (actually an alpha numeric passcode) is achievable only when a custom registry key is added to the windows registry. This action requires administrator access and the registry key is only provided by support staff at securenvoy to troubleshoot customer issues.","cvss_v4":null,"cvss_v3":{"version":"3.0","vector":"CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","score":7.0},"cwes":["CWE-532"],"references":["https://cds.thalesgroup.com/en/tcs-cert/CVE-2018-18466","https://www.excellium-services.com/cert-xlm-advisory","https://www.excellium-services.com/cert-xlm-advisory/cve-2018-18466/","https://www.excellium-services.com/cert-xlm-advisory/cve-2018-18466/"],"products":["securenvoy:securaccess"],"source":"nvd","synced_at":"2026-10-19T20:55:22.313337056+00:00"},"epss":{"cve":"CVE-2018-18466","score":0.00342,"percentile":0.27749,"date":"2026-11-01"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}