CVE-2026-11347

Published: Giu 05, 2026 Last Modified: Giu 05, 2026
ExploitDB:
Other exploit source:
Google Dorks:
HIGH 8,5
Source: 86c47df7-7d28-48da-920a-6423c52fd3da
Attack Vector: local
Attack Complexity: low
Privileges Required: low
User Interaction: none
Confidentiality: N/A
Integrity: N/A
Availability: N/A

Description

AI Translation Available

The linqi application contains hardcoded cryptographic keys. Additionally, the application uses a weak algorithm with a limited ASCII charset to dynamically generate Initialization Vectors (IVs) for AES/CBC encryption, making known-plaintext attacks feasible. An attacker with local access can leverage these vulnerabilities to decrypt sensitive obfuscated strings, including ConnectionString values containing database credentials from appsettings.json.

321

Use of Hard-coded Cryptographic Key

Draft
Abstraction: Variant Structure: Simple
Common Consequences
Security Scopes Affected:
Access Control
Potential Impacts:
Bypass Protection Mechanism Gain Privileges Or Assume Identity Read Application Data
Applicable Platforms
Technologies: ICS/OT
Likelihood of Exploit: High
View CWE Details
338

Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

Draft
Abstraction: Base Structure: Simple
Common Consequences
Security Scopes Affected:
Access Control
Potential Impacts:
Bypass Protection Mechanism
Applicable Platforms
All platforms may be affected
Likelihood of Exploit: Medium
View CWE Details
https://linqi.help/en/reference/security/security-advisorie…
https://linqi.help/en/reference/security/security-advisories/#security-advisory…