CVE-2019-8352: 
BMC Patrol Agent vulnerability analysis and mitigation

CVE-2019-8352 affects BMC PATROL Agent through version 11.3.01. The vulnerability stems from the software's default configuration which uses a static encryption key for encrypting and decrypting user credentials transmitted over the network to managed PATROL Agent services (Securifera Advisory, NVD).

The vulnerability has been assigned a CVSS v3.1 base score of 9.8 (Critical) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. This indicates that the vulnerability is network-accessible, requires low attack complexity, needs no privileges or user interaction, and can result in high impacts to confidentiality, integrity, and availability (NVD).

If an attacker can capture network traffic containing encrypted credentials, they could decrypt these credentials due to the static encryption key. The compromised credentials could then be used to execute code or escalate privileges on the network (Securifera Advisory).

The vulnerability is highly exploitable as it requires no authentication, privileges, or user interaction. The attack vector is network-accessible and requires low attack complexity (NVD).

The vulnerability can be mitigated by either changing the encryption key or enabling SSL/TLS (disabled by default). The encryption key can be modified by setting the 'PATROL_USER_MSKF' environmental variable or saving a custom key in '/etc/.psk/userk' (Securifera Advisory).