The Lansweeper components lsrunase 2.0 and lsencrypt 2.0 employ RC4 encryption with a hardcoded 142-byte static key array to protect credentials. Because an 8-character prefix is stored in cleartext next to the ciphertext, an attacker who has local access can recover any encrypted password to plaintext by performing a single SHA-1 hash and RC4 decryption operation. No brute force or additional cryptanalysis is required, making the encryption effectively reversible by an attacker with local system access.

An attacker with local access to a system running vulnerable versions of Lansweeper lsrunase 2.0 or lsencrypt 2.0 can recover encrypted passwords in plaintext. This compromises credential confidentiality and may lead to unauthorized access or privilege escalation on the affected system. The vulnerability undermines the security of stored credentials due to weak encryption and key management.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict local access to systems running these Lansweeper components to trusted users only. Monitor vendor communications for updates regarding patches or mitigations.