CVE-2024-1344 is a medium severity flaw in LaborOfficeFree version 19.10 where encrypted database credentials can be read and extracted from two program files. NVD scores it 6.8. INCIBE-CERT reports no solution at this time. Restrict access to the host and the database port.
What's affected
The record names LaborOfficeFree 19.10, the only version listed. An attacker with access to the install directory can read and extract the database username and password from LOF_service.exe and LaborOfficeFree.exe under the Program Files (x86) folder.
The record says that database user can log in remotely and has root-like privileges. The vector shows local access, low complexity and no privileges, for a score of 6.8 with high confidentiality impact.
INCIBE-CERT, the Spanish national CERT, states that there is no reported solution at this time. I did not find a fixed version, so do not assume one exists.
Weakness class: CWE-798. The NVD record carries the vector CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N and a score of 6.8.
How to check if you're exposed
Check whether LaborOfficeFree is installed and which version you run. On a Windows host:
dir "%programfiles(x86)%\LaborOfficeFree"
Then see how the database is exposed. A database account with root-like rights that can log in remotely is the real risk, so check firewall rules for the database port and who can reach it from other machines.
Safeguard has a free in-browser dependency scan at gold.safeguard.sh/scan for the libraries in your own projects, and reachability analysis helps you tell which findings your code actually calls.
What to do now
- Find every machine running LaborOfficeFree 19.10.
- Block remote access to the database port except from hosts that must use it.
- Limit who can sign in to those Windows machines, since the attack path needs local access to the files.
- Ask the vendor for a patched release or a way to change the database credentials.
- Plan a move to a supported product if no fix arrives.
Why it matters
The class is hard-coded credentials (CWE-798). Encrypting a secret that the program must decrypt to use does not protect it from a person who can read the program. The key travels with the software.
The practical risk comes from the account's privileges and remote login. If the database is reachable from other machines, a local foothold on any one workstation can become access to all the data. The KEV flag in the record is false and I found no source reporting exploitation.
Quick check
Is there a patch for CVE-2024-1344?
INCIBE-CERT says there is no reported solution at this time.
Why is it only medium?
The vector requires local access to the files. The impact once credentials are read can still be serious.
Sources
Last reviewed: 19 October 2026.
