The PDBM application contains a hard-coded encryption secret embedded in its executable (PDBM.exe). This secret is used by encryption routines, including decrypting credentials stored in the product's configuration file. Since the secret is static and identical across all installations, an attacker with sufficient local privileges can extract it from the binary. Once extracted, the attacker can decrypt stored passwords and authenticate as the user defined in the configuration file, which in the affected version has administrative privileges. This leads to full control over PDBM's management interface and operational functions. The vulnerability is identified as CWE-798 (Use of Hard-coded Credentials) and has a CVSS 3.1 base score of 6.4, indicating medium severity. There is no vendor advisory or patch available at this time, and no known exploits in the wild have been reported.

An attacker with local administrative privileges can extract the hard-coded secret from the PDBM executable, decrypt stored credentials, and authenticate as an administrative user. This compromises confidentiality, integrity, and availability of the PDBM management interface and its operational functions, potentially allowing full control over the application.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict local administrative access to trusted users only to reduce risk. Monitor for vendor updates regarding patches or official mitigations.