CVE-2026-25607
MediumCVSS 5.7Exploitation Probability (EPSS)
Low risk1th percentile - higher than 1% of all known CVEs
Summary
STER software uses a weak password encoding algorithm, allowing the password value to be guessed after analyzing how known passwords are encoded. The issue was fixed in version 9.5.
Risk Assessment
An attacker can recover user passwords, leading to unauthorized system access.
Recommendation
Upgrade STER software to version 9.5 or later, which includes the fix.
Other vulnerabilities in STER
See all- CVE-2026-25608Low
Vulnerability in STER prior to version 9.5. The application uses unencrypted TCP traffic to transmit data, enabling Man-In-The-Middle attacks and interception of sensitive data such as passwords or authentication tokens.
- CVE-2026-25606High
SQL injection vulnerability in STER allows an authenticated attacker to inject SQL via search filters, potentially reading sensitive data of other users or other application data.
Original NVD description (English source)
Use of a weak password encoding algorithm in STER software allows the value of the password to be guessed after analyzing how passwords with known values are encoded. This issue was fixed in version 9.5.