CVE-2023-38535 is a medium severity (CVSS 4.7) use of a hard-coded cryptographic key in OpenText Exceed TurboX, which could compromise the keys. The record text names 12.5.1 and 12.5.2, while its product list names 12.5.0 and 12.5.1. Read OpenText's article for the fixed version.
What's affected
The affected product is OpenText Exceed TurboX. The record says a hard-coded cryptographic key could compromise the cryptographic keys. The record is dated 2024-03-13 and scores 4.7, Medium, with the vector CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N: local access, high complexity and a low privilege requirement.
The record disagrees with itself on versions. The description says 12.5.1 and 12.5.2, while the configuration data lists 12.5.0 and 12.5.1. Treat 12.5.0, 12.5.1 and 12.5.2 as in scope until OpenText says otherwise. The record references knowledge base article KB0801267, which needs a script-capable browser, so I could not read it and cannot confirm the fixed version.
Weakness class: CWE-321, CWE-798.
How to check if you're exposed
Read the installed TurboX version from the server console and compare it with 12.5.0, 12.5.1 and 12.5.2. Then list who has local access or administrator access to the server, because the vector requires local access.
Check whether any component outside the product, such as a backup or an image, includes copies of the installed files, since a hard-coded key travels with every copy of the software.
What to do now
- Record the Exceed TurboX version on every server.
- Read OpenText KB0801267 and apply the fix or steps it lists.
- Limit local and administrator logins to the people who must have them.
- After upgrading, ask OpenText whether any keys or tokens generated earlier should be reissued.
- Keep installers and images of the product in controlled storage.
Why it matters
A hard-coded key means every installation shares the same secret. Anyone who can read the product's files can extract it, so it adds little protection against someone who has access to the software. That is why the vector needs local access and why the score is Medium.
The risk is highest when the key protects something an outsider could capture, such as stored credentials or session tokens. The fix is a per-installation key. A patch usually cannot make old protected data safe on its own, so ask the vendor whether previously protected values need to be regenerated. The CVE is not on the CISA Known Exploited Vulnerabilities list.
A hard-coded cryptographic key means the same secret is built into every copy of the software. Anyone who obtains the product can extract the key, so it protects nothing from a motivated reader. Keys should be generated per installation and stored in a protected location.
Use of hard-coded credentials means a fixed password or key is compiled into the product. Because it cannot be changed per customer, one disclosure affects every installation. Unique, rotatable secrets per deployment are the standard fix.
Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan covers the dependencies a code project declares. It does not see firmware, desktop software or vendor appliances, so keep this item in your asset inventory and track the vendor's advisory.
Quick check
Why are the versions unclear?
The record's description and its product data list different versions. Read OpenText's article for the authoritative list.
Does patching rotate the key?
That depends on the vendor's fix. Ask OpenText whether to reissue anything protected with the old key.
Sources
Last reviewed: 19 October 2026.
