CVE-2018-5551 | BDVDB-2026-98060 Detail

DocuTracDTISQLInstaller.exe

Description#

Versions of DocuTrac QuicDoc and Office Therapy that ship with DTISQLInstaller.exe version 1.6.4.0 and prior contain three credentials with known passwords: QDMaster, OTMaster, and sa.

Impact#

Per CVSS v3.0: confidentiality impact high, integrity impact high, availability impact high. Attack vector: network.

Weaknesses#

CWE-798 Use of Hard-coded Credentials

References#

https://blog.rapid7.com/2018/03/14/r7-2018-01-cve-2018-5551-cve-2018-5552-docutrac-office-therapy-installer-hard-coded-credentials-and-cryptographic-salt/

Exploit#

No public exploit known

History#

Version 12018-03-19Record published in the CVE List.
Version 22024-08-05Most recent update recorded in the CVE List.

Published

Published: 2018-03-19
Last modified: 2024-08-05

Vendor information

Vendor: DocuTrac
Product: DTISQLInstaller.exe

All DocuTrac vulnerabilities

Score

9.0 Critical

EPSS

1.6%, Low

Estimated chance of exploitation in the next 30 days. EPSS percentile: 76.1.

KEV

Not listed in the CISA Known Exploited Vulnerabilities catalog.

Impact

Hard-coded Credentials

Action

No specific action is recorded in the source data. Check the references for vendor guidance.

Affected Systems

Vulnerable
<= 1.6.4.0
Fixed
Not stated

Scoring System

CVSS v4.0

Not available

CVSS v3.1

Not available

CVSS v3.0

9.0 Critical

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Metric breakdown
Attack Vector	Network
Attack Complexity	High
Privileges Required	None
User Interaction	None
Scope	Changed
Confidentiality	High
Integrity	High
Availability	High

CVSS v2

Not available

Source: CVE List v5 (record); CISA KEV (kev, action); FIRST EPSS (epss).