The affected product uses a hard-coded blowfish key for encryption/decryption processes. The key can be easily extracted from binaries.
CWE-321, CWE-798