Because the encryption process does not utilize per-installation or per-user secrets and uses a predictable key derivation process (SHA-1 over the hardcoded suffix and the plaintext prefix), any attacker with local access to the encrypted password strings can trivially recover the plaintext credentials offline. This vulnerability allows for unauthorized password recovery without any brute-force requirements, directly exposing administrative credentials, facilitating lateral movement, and enabling the retroactive decryption of previously captured or backed-up password strings.

Impact

Successful exploitation allows local attackers to decrypt stored credentials managed by Lansweeper tools. This compromise can lead to full privilege escalation if the recovered credentials have administrative rights, and enables lateral movement across the network where those accounts are authorized. Given the prevalence of these tools in administrative environments, this vulnerability significantly increases the risk of credential harvesting and identity-based attacks.

Recommendation

1. Inventory all systems running Lansweeper lsrunase 2.0 or lsencrypt 2.0.
2. Implement strict access controls to the configuration files or registry keys where these encrypted strings are stored to prevent unauthorized access by local users.
3. Rotate all credentials that were previously stored using these versions of lsrunase or lsencrypt.
4. Migrate away from these legacy tools to modern, secure credential management solutions that support strong, non-reversible encryption standards.
5. Monitor file access events for the configuration locations of these specific tools to identify potential harvesting attempts.