Full Report
CERT Polska has received a report about 3 vulnerabilities (from CVE-2026-25606 to CVE-2026-25608) found in STER software.
Analysis Summary
# Vulnerability: Multiple Flaws in STER Software
## CVE Details
- **CVE ID:** CVE-2026-25606
- **CVSS Score:** Not explicitly provided in article (High/Critical potential)
- **CWE:** CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
- **CVE ID:** CVE-2026-25607
- **CVSS Score:** Not explicitly provided in article (Medium potential)
- **CWE:** CWE-261: Weak Encoding for Password
- **CVE ID:** CVE-2026-25608
- **CVSS Score:** Not explicitly provided in article (Medium/High potential)
- **CWE:** CWE-319: Cleartext Transmission of Sensitive Information
## Affected Systems
- **Products:** STER (developed by Centralny Instytut Ochrony Pracy - Państwowy Instytut Badawczy)
- **Versions:** All versions prior to 9.5
- **Configurations:** Default installations using standard search filters and network communication settings.
## Vulnerability Description
Three distinct security flaws were identified in the STER software:
1. **CVE-2026-25606 (SQL Injection):** The application fails to properly neutralize user-provided input within multiple "Search Filters." This allows an authenticated user to manipulate database queries.
2. **CVE-2026-25607 (Weak Password Encoding):** The software utilizes a predictable or weak algorithm to encode passwords. By analyzing the encoded output of known password values, an attacker can reverse or guess other users' passwords.
3. **CVE-2026-25608 (Cleartext Transmission):** The application communicates via unencrypted TCP traffic. This lack of encryption exposes all data transmitted across the network.
## Exploitation
- **Status:** PoC status not explicitly stated, but vulnerabilities are confirmed and coordinated with CERT Polska.
- **Complexity:**
- CVE-2026-25606: Medium (requires authenticated access)
- CVE-2026-25607: Low/Medium (requires analysis of encoding patterns)
- CVE-2026-25608: Low (requires network positioning)
- **Attack Vector:**
- CVE-2026-25606: Network (Authenticated)
- CVE-2026-25607: Local/Network
- CVE-2026-25608: Adjacent/Network (Man-in-the-Middle)
## Impact
- **Confidentiality:** High (Access to database content, user credentials, and personal data via MitM).
- **Integrity:** High (Potential to modify database records via SQL injection).
- **Availability:** Low to Medium.
## Remediation
### Patches
- **Update to Version 9.5:** All reported issues have been addressed in STER version 9.5. Users are encouraged to upgrade immediately.
### Workarounds
- **Network Isolation:** For CVE-2026-25608, use VPNs or encrypted tunnels (e.g., IPsec) to protect traffic if an upgrade is not immediately possible.
- **Access Control:** Restrict access to the application to trusted users only to mitigate the risk of SQL injection exploitation by malicious insiders.
## Detection
- **Indicators of Compromise:** Unusual SQL syntax in application logs; unauthorized access to sensitive datasets; unexpected network sniffing activity on local segments.
- **Detection methods:** Inspect network traffic for unencrypted TCP packets originating from STER; perform static or dynamic analysis on password encoding outputs.
## References
- **CERT Polska Advisory:** hxxps[://]cert[.]pl/en/posts/2026/05/vulnerabilities-in-ster-software/
- **CVE Records:**
- hxxps[://]www[.]cve[.]org/CVERecord?id=CVE-2026-25606
- hxxps[://]www[.]cve[.]org/CVERecord?id=CVE-2026-25607
- hxxps[://]www[.]cve[.]org/CVERecord?id=CVE-2026-25608