{"api_version":"1","generated_at":"2026-07-24T21:51:29+00:00","cve":"CVE-2008-2747","urls":{"html":"https://cve.report/CVE-2008-2747","api":"https://cve.report/api/cve/CVE-2008-2747.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2008-2747","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2008-2747"},"summary":{"title":"CVE-2008-2747","description":"No-IP Dynamic Update Client (DUC) 2.2.1 on Windows uses weak permissions for the HKLM\\SOFTWARE\\Vitalwerks\\DUC registry key, which allows local users to obtain obfuscated passwords and other sensitive information by reading the (1) TrayPassword, (2) Username, (3) Password, and (4) Hosts registry values.","state":"PUBLISHED","assigner":"mitre","published_at":"2008-06-18 19:41:00","updated_at":"2026-04-23 00:35:47"},"problem_types":["CWE-200","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"2.1","severity":"","vector":"AV:L/AC:L/Au:N/C:P/I:N/A:N","data":{"version":"2.0","vectorString":"AV:L/AC:L/Au:N/C:P/I:N/A:N","baseScore":2.1,"accessVector":"LOCAL","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE"}}],"references":[{"url":"http://secunia.com/advisories/30714","name":"http://secunia.com/advisories/30714","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"title":"No-IP Windows Dynamic Update Client Information Disclosure - Secunia Advisories - Vulnerability Intelligence - Secunia.com","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securityfocus.com/bid/29758","name":"http://www.securityfocus.com/bid/29758","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"No-IP DUC Client for Windows Local Information Disclosure Vulnerability","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/43298","name":"https://exchange.xforce.ibmcloud.com/vulnerabilities/43298","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"IBM X-Force Exchange","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://securityreason.com/securityalert/3952","name":"http://securityreason.com/securityalert/3952","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"DUC NO-IP Local Password Information Disclosure Vulnerability - CXSecurity.com","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securityfocus.com/archive/1/493367/100/0/threaded","name":"http://www.securityfocus.com/archive/1/493367/100/0/threaded","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"SecurityFocus","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2008-2747","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2008-2747","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2008","cve_id":"2747","vulnerable":"0","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"microsoft","cpe5":"windows","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2008","cve_id":"2747","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"no-ip","cpe5":"dynamic_update_client","cpe6":"2.2.1","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-07T09:14:14.654Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"name":"29758","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/29758"},{"name":"30714","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/30714"},{"name":"3952","tags":["third-party-advisory","x_refsource_SREASON","x_transferred"],"url":"http://securityreason.com/securityalert/3952"},{"name":"20080616 DUC NO-IP Local Password Information Disclosure Vulnerability","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred"],"url":"http://www.securityfocus.com/archive/1/493367/100/0/threaded"},{"name":"noipduc-duc-info-disclosure(43298)","tags":["vdb-entry","x_refsource_XF","x_transferred"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/43298"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2008-06-16T00:00:00.000Z","descriptions":[{"lang":"en","value":"No-IP Dynamic Update Client (DUC) 2.2.1 on Windows uses weak permissions for the HKLM\\SOFTWARE\\Vitalwerks\\DUC registry key, which allows local users to obtain obfuscated passwords and other sensitive information by reading the (1) TrayPassword, (2) Username, (3) Password, and (4) Hosts registry values."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2018-10-11T19:57:01.000Z","orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre"},"references":[{"name":"29758","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/29758"},{"name":"30714","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/30714"},{"name":"3952","tags":["third-party-advisory","x_refsource_SREASON"],"url":"http://securityreason.com/securityalert/3952"},{"name":"20080616 DUC NO-IP Local Password Information Disclosure Vulnerability","tags":["mailing-list","x_refsource_BUGTRAQ"],"url":"http://www.securityfocus.com/archive/1/493367/100/0/threaded"},{"name":"noipduc-duc-info-disclosure(43298)","tags":["vdb-entry","x_refsource_XF"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/43298"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2008-2747","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"No-IP Dynamic Update Client (DUC) 2.2.1 on Windows uses weak permissions for the HKLM\\SOFTWARE\\Vitalwerks\\DUC registry key, which allows local users to obtain obfuscated passwords and other sensitive information by reading the (1) TrayPassword, (2) Username, (3) Password, and (4) Hosts registry values."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"29758","refsource":"BID","url":"http://www.securityfocus.com/bid/29758"},{"name":"30714","refsource":"SECUNIA","url":"http://secunia.com/advisories/30714"},{"name":"3952","refsource":"SREASON","url":"http://securityreason.com/securityalert/3952"},{"name":"20080616 DUC NO-IP Local Password Information Disclosure Vulnerability","refsource":"BUGTRAQ","url":"http://www.securityfocus.com/archive/1/493367/100/0/threaded"},{"name":"noipduc-duc-info-disclosure(43298)","refsource":"XF","url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/43298"}]}}}},"cveMetadata":{"assignerOrgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","assignerShortName":"mitre","cveId":"CVE-2008-2747","datePublished":"2008-06-18T19:00:00.000Z","dateReserved":"2008-06-18T00:00:00.000Z","dateUpdated":"2024-08-07T09:14:14.654Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2008-06-18 19:41:00","lastModifiedDate":"2026-04-23 00:35:47","problem_types":["CWE-200","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:L/AC:L/Au:N/C:P/I:N/A:N","baseScore":2.1,"accessVector":"LOCAL","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE"},"baseSeverity":"LOW","exploitabilityScore":3.9,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:o:microsoft:windows:*:*:*:*:*:*:*:*","matchCriteriaId":"2CF61F35-5905-4BA9-AD7E-7DB261D2F256"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:no-ip:dynamic_update_client:2.2.1:*:*:*:*:*:*:*","matchCriteriaId":"82ADAF61-8C0C-4231-BD1F-4BB54B786B38"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2008","CveId":"2747","Ordinal":"1","Title":"CVE-2008-2747","CVE":"CVE-2008-2747","Year":"2008"},"notes":[{"CveYear":"2008","CveId":"2747","Ordinal":"1","NoteData":"No-IP Dynamic Update Client (DUC) 2.2.1 on Windows uses weak permissions for the HKLM\\SOFTWARE\\Vitalwerks\\DUC registry key, which allows local users to obtain obfuscated passwords and other sensitive information by reading the (1) TrayPassword, (2) Username, (3) Password, and (4) Hosts registry values.","Type":"Description","Title":"CVE-2008-2747"},{"CveYear":"2008","CveId":"2747","Ordinal":"2","NoteData":"2008-06-18","Type":"Other","Title":"Published"},{"CveYear":"2008","CveId":"2747","Ordinal":"3","NoteData":"2018-10-11","Type":"Other","Title":"Modified"}]}}}