The Linqi application embeds cryptographic keys directly in its codebase and constructs AES/CBC initialization vectors using a limited ASCII character set. This combination renders the encryption scheme vulnerable to known‑plaintext attacks. An adversary who gains local access can exploit the fixed keys and predictable IVs to decrypt obfuscated strings, including database connection strings stored in appsettings.json, thereby exposing credentials and related sensitive data.

The affected product is Linqi developed by linqi GmbH. No specific version information was supplied, indicating that all releases potentially contain the hardcoded keys and weak IV algorithm.

The CVSS score of 8.5 reflects a high severity vulnerability. The EPSS score is not available, and the issue is not listed in the CISA KEV catalog. The attack is inferred to require local access; attackers with the ability to run code on the target system can directly read and decrypt configuration values. The combination of hardcoded keys and predictable IVs makes large‑scale exploitation feasible if local foothold is achieved.