CVE-2022-25805: 
IGEL Universal Management Suite vulnerability analysis and mitigation

An issue was discovered in the IGEL Universal Management Suite (UMS) 6.07.100 related to the transmission of cleartext LDAP bind credentials. The vulnerability allows remote authenticated attackers to obtain access to LDAP bind credentials in both encrypted and plaintext forms (NVD, Atredis Advisory).

The vulnerability exists in the cmdmgtloadmgttree command functionality, which instructs UMS to return data of type de.igel.rm.mgt.common.data.MgtTreeData that includes ADRootMasterData. This ADRootMasterData contains Active Directory configuration data including the bind credentials used to search AD. The AD bind password is encrypted using DES with a hardcoded 8-byte static key that is known to both UMS and the UMS Console (Atredis Advisory).

A successful exploitation of this vulnerability could allow remote authenticated attackers to obtain access to LDAP bind credentials, potentially leading to unauthorized access to Active Directory resources and sensitive information (Atredis Advisory).

The vendor recommends using only TLS-secured variants of LDAP access as a mitigation measure. Additionally, it is recommended to keep the UMS database and its backups under strict access control (Atredis Advisory).