Cleartext Credential Exposure in No-IP Dynamic Update Client v3.x
CVE-2024-40457
Currently unrated
What is CVE-2024-40457?
The No-IP Dynamic Update Client (DUC) v3.x version stores cleartext credentials, potentially exposing sensitive information through command line usage or within configuration files. Despite security concerns, the vendor maintains that this cleartext usage in the specified file is intentional, raising implications for users regarding the management and protection of their credentials.
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.