CVE-2025-10080
BaseFortify
Publication date: 2025-09-08
Last updated on: 2026-04-29
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| running-elephant | datart | 1.0.0-rc3 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-321 | The product uses a hard-coded, unchangeable cryptographic key. |
| CWE-320 | Key Management Errors |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-10080 is a vulnerability in Elephant Datart version 1.0.0-rc3 where a hard-coded cryptographic key is used in the AES encryption method getTokensecret. This means that sensitive information, such as database passwords, is encrypted with a default key that attackers can know and use to decrypt the data. As a result, attackers can obtain sensitive credentials by intercepting API responses that expose encrypted passwords and decrypting them using the hard-coded key. [1, 2, 3]
How can this vulnerability impact me? :
This vulnerability can lead to unauthorized disclosure of sensitive information, specifically database credentials. If the default AES key is not changed by the administrator, an attacker can remotely decrypt encrypted passwords and gain access to the database. This compromises the confidentiality of the system and may allow attackers to further exploit the system or access sensitive data. [1, 2, 3]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by capturing and analyzing network traffic for API response packets that expose database usernames in plaintext and AES-encrypted passwords. Since the AES encryption uses a hard-coded key, you can attempt to decrypt captured encrypted passwords using the known default key from the getTokensecret method in AESUtil.java. Commands such as 'tcpdump' or 'Wireshark' can be used to capture network packets. For example, use 'tcpdump -i <interface> -w capture.pcap port <datart_api_port>' to capture traffic, then analyze the capture for sensitive data exposure. Additionally, reviewing the source code or binaries for the presence of the hard-coded key in AESUtil.java can help detect vulnerable installations. [1, 2]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include replacing or patching the affected component to remove the hard-coded cryptographic key. Since no known countermeasures or mitigations have been documented, it is recommended to upgrade to a version of Elephant Datart that does not contain this vulnerability or switch to an alternative product. Additionally, restrict access to the API to trusted users and monitor for suspicious activity. If possible, change the default AES key to a secure, unique key to prevent attackers from decrypting sensitive data. [3, 1]