CVE-2026-25608 LOW

CVE-2026-25608: Lack of traffic encryption in STER

Vendor Centralny Instytut Ochrony Pracy - Państwowy Instytut Badawczy
Product STER
Weakness CWE-319 · Cleartext transmission
Published May 22, 2026
Last update May 22, 2026
View on NVD All CVEs

CVSS base score

2.3/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction —
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

What the vulnerability does

01Description

STER uses unencrypted TCP traffic to transmit data over the network. It allows an attacker to conduct a Man-In-The-Middle attack and obtain sensitive data such as passwords, personal data, or authentication tokens. This issue was fixed in version 9.5.

Key dates

02Disclosure timeline

May 22, 2026 CVE published
May 22, 2026 Record updated