CVE-2026-25608
STER Network Traffic Exposure via Unencrypted TCP Allows MITM Data Theft
Publication date: 2026-05-22
Last updated on: 2026-05-22
Assigner: CERT.PL
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| ster | ster | 9.5 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-319 | The product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists because STER transmits data over the network using unencrypted TCP traffic.
An attacker can exploit this by performing a Man-In-The-Middle (MITM) attack, intercepting the network traffic.
Through this interception, the attacker can obtain sensitive information such as passwords, personal data, or authentication tokens.
How can this vulnerability impact me? :
The vulnerability can lead to unauthorized access to sensitive data transmitted over the network.
- Exposure of passwords could allow attackers to compromise user accounts.
- Personal data interception can lead to privacy breaches.
- Authentication tokens being stolen can enable attackers to impersonate legitimate users.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, you should upgrade STER to version 9.5 or later, where the issue has been fixed.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability allows an attacker to conduct a Man-In-The-Middle attack and obtain sensitive data such as passwords, personal data, or authentication tokens by intercepting unencrypted TCP traffic.
This exposure of sensitive personal data could lead to non-compliance with data protection regulations such as GDPR and HIPAA, which require the protection of personal and sensitive information during transmission.
Using unencrypted communication channels for sensitive data transmission is generally considered a violation of these standards, potentially resulting in legal and regulatory consequences.