CVE-2024-36049

CVE-2024-36049 describes a critical vulnerability in Aptos Wisal payroll accounting software prior to version 7.1.6, where the Windows client utilizes hardcoded credentials to retrieve all usernames and passwords from the database server over an unencrypted connection. This flaw allows attackers performing a machine-in-the-middle (MitM) attack to gain read and write access to sensitive PII and payroll data, as well as impersonate legitimate users. Rated 6.5 MEDIUM, the vulnerability has a low attack complexity and high impact on confidentiality, but currently shows no evidence of active exploitation, public exploit code, or significant community discussion.