Calero VeraSMART versions before 2026 R1 store the service account password in C:\VeraSMART Data\app.settings encrypted with a hard‑coded static AES key embedded in Veramark.Framework.dll. An attacker with local access can pull this key from the DLL, decrypt the credentials, and use the recovered account to log into the Windows host. If the service account runs with administrative privileges, this can lead to local privilege escalation. The weakness corresponds to improper authentication strength (CWE‑798).

The vulnerable product is Calero VeraSMART from the vendor Calero. All releases earlier than 2026 R1 contain the hard‑coded key and are affected. The attack applies to systems where the VeraSMART Data directory and the Veramark.Framework.dll DLL are present.

This vulnerability has a CVSS score of 8.5 and an EPSS score below 1 percent, indicating low current exploitation probability but high impact if exploited. The attack is local only, requiring physical or software access to the machine, and is listed as not in the CISA KEV catalog. Given the severity and low EPSS, administrators should treat this as a high‑priority issue when local access is possible.