Weak entropy exposes encrypted credentials in Thales CPL Safenet Authentication Service

A user of a machine protected by SafeNet Agent for Windows Logon may leverage weak entropy to access the encrypted credentials of any or all the users on that machine.

• Product: Thales CPL Safenet Authentication Service deployments using the Windows Logon Agent component.
• Affected boundary: Windows Logon Agent versions less than 3.4.4 are marked as affected.
• The available evidence does not provide a separate parallel branch, additional platform qualifier, or independent status statement for other branches. Do not infer the status of unverified branches.

The weakness is insufficient entropy in the protection of encrypted credentials handled by the Windows Logon Agent. Under the CNA assessment, a user with local access to a protected machine may, with high attack complexity and user interaction, exploit the weakness to access credentials belonging to one or more users on that machine. The CNA assessment describes a scope that may cross user-account boundaries, but it does not identify a remote entry point. The available evidence does not disclose the entropy source, key-generation or key-derivation mechanism, storage location, exact user interaction, or any specific attacker-controlled parameter, so those implementation details should not be assumed.

The CNA assessment describes local reachability, low required privileges, high complexity, and required user interaction. The product description does not confirm remote reachability. NVD displays a separate network-oriented assessment, but that difference is not sufficient to establish a remote attack path for the product; this entry gives precedence to the product description and CNA assessment. The supplied evidence does not confirm a public exploit, observed exploitation, ransomware campaign, or specific exploitation indicators; this status remains unknown rather than proving that exploitation has not occurred.

The weakness may expose encrypted credentials for one or more users on the same machine, crossing the account boundaries that the protection mechanism is intended to maintain. The CNA assessment also indicates potential integrity impact because credentials for another account could enable actions under that account; however, the specific post-access capabilities are not documented. The CNA assessment does not identify an availability effect. Actual consequences depend on the account types, permissions, and resources available to the exposed credentials.

Protected credentials on an affected machine may be accessed by an unauthorised local user, increasing the risk of exposure for one or more accounts. If those credentials are misused, the consequences could extend to resources or actions available to the affected accounts, but the available evidence does not establish a specific intrusion scenario, victim, or breach. Because the weakness may expose credentials for multiple users on one machine, workstations and servers with several accounts should receive priority review. Organisations should determine whether potentially exposed credentials require rotation under their incident-response and identity-management procedures.

1. Upgrade affected deployments to Windows Logon Agent version 3.4.4, the recorded boundary excluding affected versions. Confirm the applicable Thales CPL update package and deployment instructions before broad rollout.
2. Re-inventory systems after the update to verify that the installed agent has actually been replaced and is no longer within the affected boundary. Do not assume that other release branches are covered without separate confirmation.
3. If an immediate update is not possible, reduce untrusted local-user access to systems containing credentials protected by the agent and strengthen physical-access, session, and account-privilege controls as temporary compensating measures.
4. Assess credentials on systems that may have been accessible to untrusted local users. If exposure cannot be ruled out, rotate or revoke those credentials according to the organisation's identity-management and incident-response procedures.

• Inventory Windows systems running Thales CPL Safenet Authentication Service and the Windows Logon Agent component.
• Compare installed versions with the vendor's affected boundary and update guidance, prioritising systems with multiple user accounts or credentials protected by the agent.
• Review deployment records, update logs, and software-management status to confirm that systems received the appropriate remediation.
• No vendor-confirmed IOC, log event, file path, endpoint, or command is provided in the available evidence. Monitoring unusual local access is only a precaution, and the absence of suspicious logs does not prove that a system is safe.