CVE-2023-39420: Resortdata Internet Reservation Module Next Generation

High severity, CVSS 8.8. EPSS: 0.7% chance of exploitation in the next 30 days.

The RDPCore.dll component as used in the IRM Next Generation booking engine, allows a remote user to connect to customers with an "admin" account and a corresponding password computed daily by a routine inside the DLL file. Once reverse-engineered, this routine can help an attacker generate the daily password and connect to application customers. Given that this is an administrative account, anyone logging into a customer deployment has full, unrestricted access to the application.

Affected products

• Resortdata Internet Reservation Module Next Generation: version 5.3.2.15 only

Published 2023-09-07. Last modified 2026-06-17.