Lansweeper lsrunase 2.0 and lsencrypt 2.0 use RC4 encryption with a hardcoded 142‑byte static key array to encrypt credentials. An 8‑character prefix is stored in cleartext next to the ciphertext. This flaw lets an attacker with local access recover any stored password to plaintext using a single SHA‑1 hash and an RC4 decryption operation, with no brute‑force effort required.

The affected products are Lansweeper lsrunase 2.0 and lsencrypt 2.0, as referenced in the advisory sources. No further vendor or version details are available beyond the version numbers provided.

Although a CVSS score is not provided, the combination of a hardcoded key and the weak RC4 cipher exposes stored credentials to any local attacker. Exploitation requires only local file access and no computational work, making the attack straightforward. The EPSS score is unavailable and the issue is not yet listed in CISA KEV, so current exploitation frequency is unknown. Nevertheless, compromised credentials could lead to additional privilege escalation or unauthorized access.