CVE-2026-25608
LowCVSS 2.3Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
Vulnerability in STER prior to version 9.5. The application uses unencrypted TCP traffic to transmit data, enabling Man-In-The-Middle attacks and interception of sensitive data such as passwords or authentication tokens.
Risk Assessment
The risk is the possibility of an attacker intercepting confidential data over the network, which could lead to compromise of user accounts.
Recommendation
It is recommended to update STER to version 9.5 or later, which includes a fix to secure the transmission.
Other vulnerabilities in STER
See all- CVE-2026-25607Medium
STER software uses a weak password encoding algorithm, allowing the password value to be guessed after analyzing how known passwords are encoded. The issue was fixed in version 9.5.
- CVE-2026-25606High
SQL injection vulnerability in STER allows an authenticated attacker to inject SQL via search filters, potentially reading sensitive data of other users or other application data.
Original NVD description (English source)
STER uses unencrypted TCP traffic to transmit data over the network. It allows an attacker to conduct a Man-In-The-Middle attack and obtain sensitive data such as passwords, personal data, or authentication tokens. This issue was fixed in version 9.5.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS