CVE-2026-25608

LowCVSS 2.3/10Last modified Jul 23, 2026

Description

STER uses unencrypted TCP traffic to transmit data over the network. It allows an attacker to conduct a Man-In-The-Middle attack and obtain sensitive data such as passwords, personal data, or authentication tokens.

This issue was fixed in version 9.5.

Metrics

CVSS 4.0 2.3/10

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-319

Affected software

No affected versions have been published.

Timeline

Published: May 22, 2026
Last modified: Jul 23, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-256094.3Incorrect validation of the profile command may result in the determination that a request altering the 'filter' is read-only.CVE-2026-25618.8A vulnerability was found in JingDong JD Cloud Box AX6600 up to 4.5.1.r4533. This affects the function web_get_ddns_uptime of the file /jdca CVE-2026-256106.5An authorized user may trigger a server crash by running a $geoNear pipeline with certain invalid index hints.CVE-2026-256117.5A series of specifically crafted, unauthenticated messages can exhaust available memory and crash a MongoDB server.CVE-2026-256126.5The internal locking mechanism of the MongoDB server uses an internal encoding of the resources in order to choose what lock to take. Collec CVE-2026-256136.5An authorized user may disable the MongoDB server by issuing a query against a collection that contains an invalid compound wildcard index.CVE-2026-256147.5Blesta 3.x through 5.x before 5.13.3 allows object injection, aka CORE-5680.CVE-2026-256157.2Blesta 3.x through 5.x before 5.13.3 allows object injection, aka CORE-5668.CVE-2026-256166.1Blesta 3.x through 5.x before 5.13.3 mishandles input validation, aka CORE-5665.CVE-2026-25628.8A vulnerability was determined in JingDong JD Cloud Box AX6600 up to 4.5.1.r4533. This impacts the function cast_streen of the file /jdcapi CVE-2026-256206.0An encrypted password command injection vulnerability exists in the Captive Portal application framework of Arista Edge Threat Management - CVE-2026-256216.0A Reports application infrastructure vulnerability exists in Arista Edge Threat Management - Arista Next Generation Firewall (NGFW) due to i