CVE-2026-39031: Lansweeper lsrunase 2.0 / lsencrypt 2.0 Password Recovery

Summary

Lansweeper lsrunase 2.0 and lsencrypt 2.0 use a reversible password encryption scheme based on RC4. The RC4 key is derived from an 8-character prefix that is stored in cleartext with the encrypted password and fixed key material embedded in the binaries.

Anyone who has an encrypted password string produced by either tool can recover the plaintext password offline. The recovery process requires no brute force: split the cleartext prefix from the encrypted value, rebuild the key buffer, compute one SHA-1 digest, and decrypt one RC4 ciphertext.

This issue was assigned CVE-2026-39031. Public CVE and NVD records may not appear until the disclosure is published and record propagation completes.

Affected Products

The affected component is the password encryption routine used by lsrunase.exe 2.0 and lsencrypt.exe 2.0.

Distinction From Older LSrunasE Issues

This is not the older LSrunasE / Supercrypt issue tracked as CVE-2007-6340. That older CVE affected Geert Moernaut LSrunasE 1.0 and Supercrypt 1.0.

CVE-2026-39031 specifically covers Lansweeper lsrunase 2.0 and lsencrypt 2.0. The vulnerable construction is different: these binaries derive the RC4 key from a cleartext 8-character prefix plus a fixed 142-byte suffix embedded in the binaries.

Technical Details

An encrypted password value is built as:

8-character prefix || base64(RC4(plaintext password))

The encryption process is:

1. Generate an 8-character ASCII prefix in the range 0x3f through 0x7e.
2. Build a 150-byte key buffer from the 8-byte prefix followed by a fixed 142-byte suffix embedded in the binary.
3. Compute SHA1(key_buffer) to produce the 20-byte RC4 key.
4. Encrypt the plaintext password with RC4.
5. Base64-encode the RC4 ciphertext.
6. Prepend the original 8-character prefix to the Base64 output.

The fixed 142-byte suffix is:

0x27 0x0F 0x29 0x11 0x2B 0x13 0x2D 0x15
0x2F 0x17 0x31 0x19 0x33 0x1B 0x35 0x1D
0x37 0x1F 0x39 0x21 0x3B 0x23 0x3D 0x25
0x3F 0x27 0x41 0x29 0x43 0x2B 0x45 0x2D
0x47 0x2F 0x49 0x31 0x4B 0x33 0x4D 0x35
0x4F 0x37 0x51 0x39 0x53 0x3B 0x55 0x3D
0x57 0x3F 0x59 0x41 0x5B 0x43 0x5D 0x45
0x5F 0x47 0x61 0x49 0x63 0x4B 0x65 0x4D
0x67 0x4F 0x69 0x51 0x6B 0x53 0x6D 0x55
0x6F 0x57 0x71 0x59 0x73 0x5B 0x75 0x5D
0x77 0x5F 0x79 0x61 0x7B 0x63 0x7D 0x65
0x7F 0x67 0x81 0x69 0x83 0x6B 0x85 0x6D
0x87 0x6F 0x89 0x71 0x8B 0x73 0x8D 0x75
0x8F 0x77 0x91 0x79 0x93 0x7B 0x95 0x7D
0x97 0x7F 0x99 0x81 0x9B 0x83 0x9D 0x85
0x9F 0x87 0xA1 0x89 0xA3 0x8B 0xA5 0x8D
0xA7 0x8F 0xA9 0x91 0xAB 0x93 0xAD 0x95
0xAF 0x97 0xB1 0x99 0xB3 0x9B

Because the prefix is stored in cleartext and the remaining key material is fixed across installations, all information needed to derive the RC4 key is available to an attacker who has an encrypted password string and a copy of the binary or this analysis.

Proof of Concept

The proof-of-concept script has no third-party dependencies and runs with Python 3.

$ python lsrunase2cve.py --decrypt "IssS|CI|NTOEHK5Q9l7Sn89xEA67+wo="
Decrypted: testpassword12345

The encrypted value above was generated by the LSrunasE 2.0 password encrypter 2.0 GUI for the plaintext value testpassword12345.

For a reproducible encryption check using the same prefix:

$ python lsrunase2cve.py --encrypt "testpassword12345" --prefix "IssS|CI|"
Encrypted: IssS|CI|NTOEHK5Q9l7Sn89xEA67+wo=

Impact

An attacker with local access to an encrypted password value produced by lsrunase 2.0 or lsencrypt 2.0 can recover the plaintext password offline.

Depending on how the tools are deployed, recovered credentials may allow:

• Privilege escalation through use of stored administrative credentials.
• Lateral movement to systems where the recovered account is valid.
• Reuse of recovered credentials against other services.
• Retroactive decryption of previously captured or backed-up encrypted password strings.

Root Cause

The issue is caused by several cryptographic design problems in the password protection scheme:

• RC4 is used for encryption.
• The effective secret key material is embedded in the binaries.
• The random prefix is stored in cleartext with the ciphertext.
• SHA-1 is used as a single-pass key derivation step.
• There is no per-installation or per-user secret.
• Passwords are stored in a reversible form.

Relevant weakness categories include:

• CWE-321: Use of Hard-coded Cryptographic Key
• CWE-326: Inadequate Encryption Strength
• CWE-327: Use of a Broken or Risky Cryptographic Algorithm

Disclosure Timeline

References

• CVE record, pending public publication: https://www.cve.org/CVERecord?id=CVE-2026-39031
• NVD record, pending public publication: https://nvd.nist.gov/vuln/detail/CVE-2026-39031
• CWE-321: https://cwe.mitre.org/data/definitions/321.html
• CWE-326: https://cwe.mitre.org/data/definitions/326.html
• CWE-327: https://cwe.mitre.org/data/definitions/327.html
• RFC 7465, "Prohibiting RC4 Cipher Suites": https://datatracker.ietf.org/doc/html/rfc7465
• Older, distinct CVE-2007-6340 record: https://nvd.nist.gov/vuln/detail/CVE-2007-6340