Cleartext Transmission of Sensitive Information in WorkExaminer Professional

An attacker with access to the relevant network path can passively intercept and read sensitive data transmitted between WorkExaminer Professional components. Because the traffic is unencrypted, an attacker can also actively modify data in transit, enabling manipulation of client-to-server or console-to-server communications. The resulting impact includes loss of confidentiality for monitored data and loss of integrity for application traffic, with potential downstream effects depending on what data and commands are exchanged over those channels.

Until a fix is deployed, restrict network exposure of WorkExaminer Professional services to trusted management networks only, and prevent access from untrusted or shared segments. Use network segmentation, VPN tunnels, or other compensating controls to provide encryption for traffic in transit where possible. Monitor for unauthorized access to ports 12304 and 12306, and treat any network where these services traverse as sensitive because on-path interception and modification are possible. If operationally feasible, disable or limit use of the affected components until secure transport is available.

Upgrade to a vendor-provided fixed version of WorkExaminer Professional, if available, that encrypts all client/server and console/server communications and eliminates use of plaintext FTP for telemetry transfer. Replace FTP-based transport with a secure protocol such as FTPS or SFTP as supported by the vendor, and ensure console communications are protected with TLS. If a patch or secure configuration guidance is available from the vendor, apply it across all deployed clients, consoles, and servers.