CVE-2015-0922

CVE-2015-0922 describes a critical vulnerability in McAfee ePolicy Orchestrator (ePO) versions prior to 4.6.9 and 5.x prior to 5.1.2. The flaw stems from the use of a hardcoded secret key across all customer installations, enabling attackers to decrypt the administrator password if they obtain the encrypted value. This vulnerability carries a CVSS score of 5.0, indicating a medium severity, and allows for unauthorized information disclosure (C:P) with low attack complexity (AC:L) and no authentication required (Au:N). While not observed in active exploitation (KEV: No), a Metasploit module exists for authenticated XXE credentials exposure, and its EPSS score suggests a higher-than-average likelihood of exploitation despite limited public discussion or media coverage.