The Lansweeper lsrunase 2.0 and lsencrypt 2.0 components employ RC4 encryption with a fixed 142-byte static key array to protect credentials. Because the encryption key is hardcoded and an 8-character prefix is stored in plaintext, an attacker with local access can decrypt any stored password by performing a single SHA-1 hash and RC4 decryption operation, bypassing the need for brute force. This vulnerability is identified as CWE-321 (Use of Hard-coded Cryptographic Key). There is no available vendor advisory or patch information at this time.

An attacker with local access can recover plaintext passwords from encrypted credentials without requiring brute force, potentially leading to credential compromise. The confidentiality of stored credentials is directly impacted. There is no indication of impact on integrity or availability. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict local access to trusted users only and monitor for unauthorized access attempts. Avoid relying on the affected encryption method for sensitive credential storage.