Full Report
Use of Hard-coded Password vulnerability (CVE-2025-3920) has been found in SUR-FBD CMMS software.
Analysis Summary
# Vulnerability: Hard-coded Administrative Credentials in SUR-FBD CMMS
## CVE Details
- CVE ID: CVE-2025-3920
- CVSS Score: Information not provided (Severity undetermined based on source)
- CWE: CWE-259 (Use of Hard-coded Password)
## Affected Systems
- Products: SUR-FBD CMMS software
- Versions: All versions prior to 2025.03.27
- Configurations: Assumes standard installation configuration. Requires local access to the system or application directory for exploitation.
## Vulnerability Description
The vulnerability exists within the SUR-FBD CMMS software where hard-coded credentials for a built-in administrative account were discovered within a compiled DLL file. An attacker who can access the system locally or manipulate the application's installation directory can extract these embedded credentials.
## Exploitation
- Status: PoC required (Details regarding active exploitation or PoC availability were not provided, but extraction is feasible with local access.)
- Complexity: Low (Assuming successful extraction of credentials from the DLL, exploitation would be straightforward.)
- Attack Vector: Local (Requires attacker to have file system access to the host running the CMMS).
## Impact
- Confidentiality: High (Administrative credentials allow access to sensitive CMMS data)
- Integrity: High (Potential to alter system configurations and data)
- Availability: Medium (Could lead to service disruption if administrative functions are misused)
## Remediation
### Patches
- **Fixed Version:** SUR-FBD CMMS version 2025.03.27
### Workarounds
- No specific vendor workarounds were provided in the source material. Mitigation relies on patching, though restricting local access could temporarily reduce the attack surface.
## Detection
- **Indicators of Compromise:** Unauthorized administrative logins or configuration changes originating internally.
- **Detection methods and tools:** File integrity monitoring on the application's DLL files within the installation directory may reveal tampering attempts.
## References
- Vendor advisories: CERT Polska (Source of the advisory)
- Relevant links - defanged:
- https://cert.pl/en/cve
- https://www.cve.org/CVERecord?id=CVE-2025-3920