CVE-2013-7287: 
Ivanti MobileIron Sentry vulnerability analysis and mitigation

MobileIron VSP versions prior to 5.9.1 and Sentry versions prior to 5.0 contain an insecure encryption scheme vulnerability identified as CVE-2013-7287. The vulnerability was discovered during a security assessment and was publicly disclosed in December 2013 (Mailing List).

The vulnerability stems from the implementation of an insecure encryption scheme in MobileIron's products. The system uses AES-ECB-PKCS1.5 with a known, shared key for encryption, which is fundamentally insecure. This vulnerability has been assigned a CVSS v3.1 base score of 9.8 CRITICAL (Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) (NVD).

The vulnerability could allow attackers to decrypt sensitive information stored in the system. Due to the use of a known, shared encryption key, any encrypted data within the affected versions could be compromised, potentially exposing sensitive organizational data (Mailing List).

The vendor has addressed this vulnerability by implementing a stronger encryption method in version 5.7 and later releases. Organizations should upgrade VSP to version 5.9.1 or later, and Sentry to version 5.0 or later to mitigate this vulnerability (Mailing List).