CVE-2019-13022

CVE-2019-13022 is a critical vulnerability affecting all versions of Bond JetSelect, stemming from a flawed password generation algorithm in the ENCtool.jar Java class. This flaw allows for trivial reversal of "encrypted" passwords stored in the database due to a simple XOR operation, enabling attackers to obtain administrator credentials. With a CVSS score of 9.8, this vulnerability presents a severe risk of privilege escalation, allowing unauthorized modification and deletion of critical networking configurations on vessels and managed network devices. There is currently no evidence of active exploitation, and no public exploit code or significant community discussion has been observed.