---
id: CVE-2026-121023
title: LDAP Bind Password Exposure in AxxonNet ARP Agent Logs
summary: >-
  Insertion of Sensitive Information into Log File (CWE-532) in the ARP Agent
  component in AxxonSoft AxxonNet before 3.25.0 on Windows and Linux allows a
  local attacker with read access to ARP Agent log files or support packages to
  obtain …
severity: medium
cvss: 5.5
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'
cvssSource: cna
cwe:
  - CWE-532
vendor: AxxonSoft
product: AxxonNet ARP Agent
affected:
  - axxonnet_arp_agent < 3.25.0
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-03T20:17:13.956624Z'
published: '2026-11-03'
updated: '2026-11-03'
sourceUpdated: '2026-11-03T20:17:26.457Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-121023'
references:
  - url: >-
      https://www.axxonsoft.com/legal/axxonsoft-vulnerability-disclosure-policy/security-advisories#CVE-2026-121023
tags:
  - cve.org
epss: 0.00101
epssPercentile: 0.00886
ingestedAt: '2026-11-05T20:33:06.440Z'
---

## Overview

Insertion of Sensitive Information into Log File (CWE-532) in the ARP Agent component in AxxonSoft AxxonNet before 3.25.0 on Windows and Linux allows a local attacker with read access to ARP Agent log files or support packages to obtain the plaintext password of the LDAP directory service account via WARNING-level log entries that contain serialized user synchronization data.

## Affected

- `axxonnet_arp_agent < 3.25.0`

## Remediation

Upgrade the ARP Agent to version 3.25.0 or later (delivered with Axxon One 2.0.16 and later). Rotate the password of the LDAP service account used for directory synchronization, and delete or restrict access to old ARP Agent log files and support packages.