Vulnerability-Lookup

CVE-2025-57796 (GCVE-0-2025-57796)

Vulnerability from cvelistv5 – Published: 2026-01-28 17:47 – Updated: 2026-01-28 18:11

Title

Use of a hardcoded static key to protect sensitive data in Explorance Blue

Summary

Explorance Blue versions prior to 8.14.12 use reversible symmetric encryption with a hardcoded static key to protect sensitive data, including user passwords and system configurations. This approach allows stored values to be decrypted offline if the encrypted data are obtained.

Severity

6.8 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-01-28 18:10 UTC

CWE

CWE-257 - Storing Passwords in a Recoverable Format

Assigner

Mandiant Google root

References

4 references

URL	Tags
https://www.explorance.com/products/blue	product
https://online-help.explorance.com/blue/articles/…	vendor-advisory
https://online-help.explorance.com/blue/articles/…	vendor-advisory
https://github.com/mandiant/Vulnerability-Disclos…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version	CPE status
Explorance	Blue	Affected: 0 , < 8.14.12 (custom)	guessed

Credits

Abdulrahman Nour, Mandiant Abdulrahman Nour, Mandiant

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 6.8,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "NONE",
              "privilegesRequired": "HIGH",
              "scope": "CHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-57796",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-28T18:10:56.263409Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-01-28T18:11:13.946Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Blue",
          "vendor": "Explorance",
          "versions": [
            {
              "lessThan": "8.14.12",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Abdulrahman Nour, Mandiant"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "Abdulrahman Nour, Mandiant"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Explorance Blue versions prior to 8.14.12 use reversible symmetric encryption with a hardcoded static key to protect sensitive data, including user passwords and system configurations. This approach allows stored values to be decrypted offline if the encrypted data are obtained."
            }
          ],
          "value": "Explorance Blue versions prior to 8.14.12 use reversible symmetric encryption with a hardcoded static key to protect sensitive data, including user passwords and system configurations. This approach allows stored values to be decrypted offline if the encrypted data are obtained."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-50",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-50 Password Recovery Exploitation"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-257",
              "description": "CWE-257:Storing Passwords in a Recoverable Format",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-01-28T17:49:50.244Z",
        "orgId": "027e81ed-0dd4-4685-ab4d-884aec5bb484",
        "shortName": "Mandiant"
      },
      "references": [
        {
          "tags": [
            "product"
          ],
          "url": "https://www.explorance.com/products/blue"
        },
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://online-help.explorance.com/blue/articles/security-advisories-(january-2026)"
        },
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://online-help.explorance.com/blue/articles/security-advisory:-cve-2025-57796"
        },
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2026/MNDT-2026-0005.md"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Use of a hardcoded static key to protect sensitive data in Explorance Blue",
      "x_generator": {
        "engine": "Vulnogram 0.5.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "027e81ed-0dd4-4685-ab4d-884aec5bb484",
    "assignerShortName": "Mandiant",
    "cveId": "CVE-2025-57796",
    "datePublished": "2026-01-28T17:47:56.607Z",
    "dateReserved": "2025-08-19T19:08:41.742Z",
    "dateUpdated": "2026-01-28T18:11:13.946Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-57796",
      "date": "2026-09-17",
      "epss": "0.00189",
      "percentile": "0.0878"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-57796\",\"sourceIdentifier\":\"mandiant-cve@google.com\",\"published\":\"2026-01-28T18:16:49.940\",\"lastModified\":\"2026-06-17T09:43:27.100\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Explorance Blue versions prior to 8.14.12 use reversible symmetric encryption with a hardcoded static key to protect sensitive data, including user passwords and system configurations. This approach allows stored values to be decrypted offline if the encrypted data are obtained.\"},{\"lang\":\"es\",\"value\":\"Las versiones de Explorance Blue anteriores a la 8.14.12 utilizan cifrado sim\u00e9trico reversible con una clave est\u00e1tica codificada de forma r\u00edgida para proteger datos sensibles, incluyendo contrase\u00f1as de usuario y configuraciones del sistema. Este enfoque permite que los valores almacenados sean descifrados sin conexi\u00f3n si se obtienen los datos cifrados.\"}],\"affected\":[{\"source\":\"mandiant-cve@google.com\",\"affectedData\":[{\"vendor\":\"Explorance\",\"product\":\"Blue\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"0\",\"lessThan\":\"8.14.12\",\"versionType\":\"custom\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N\",\"baseScore\":6.8,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"HIGH\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.3,\"impactScore\":4.0}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-01-28T18:10:56.263409Z\",\"id\":\"CVE-2025-57796\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"mandiant-cve@google.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-257\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:explorance:blue:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"8.14.12\",\"matchCriteriaId\":\"4DE2E7BA-5E00-494C-9737-45F26E3384F2\"}]}]}],\"references\":[{\"url\":\"https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2026/MNDT-2026-0005.md\",\"source\":\"mandiant-cve@google.com\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://online-help.explorance.com/blue/articles/security-advisories-(january-2026)\",\"source\":\"mandiant-cve@google.com\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://online-help.explorance.com/blue/articles/security-advisory:-cve-2025-57796\",\"source\":\"mandiant-cve@google.com\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://www.explorance.com/products/blue\",\"source\":\"mandiant-cve@google.com\",\"tags\":[\"Product\"]}]}}",
    "redhat_vex": {
      "current_release_date": "2026-01-29T21:21:12+00:00",
      "cve": "CVE-2025-57796",
      "id": "CVE-2025-57796",
      "initial_release_date": "2025-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "Use of a hardcoded static key to protect sensitive data in Explorance Blue",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-57796.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"CHANGED\", \"version\": \"3.1\", \"baseScore\": 6.8, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"HIGH\", \"confidentialityImpact\": \"HIGH\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2025-57796\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-01-28T18:10:56.263409Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-01-28T18:10:22.465Z\"}}], \"cna\": {\"title\": \"Use of a hardcoded static key to protect sensitive data in Explorance Blue\", \"source\": {\"discovery\": \"UNKNOWN\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"Abdulrahman Nour, Mandiant\"}, {\"lang\": \"en\", \"type\": \"reporter\", \"value\": \"Abdulrahman Nour, Mandiant\"}], \"impacts\": [{\"capecId\": \"CAPEC-50\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"CAPEC-50 Password Recovery Exploitation\"}]}], \"affected\": [{\"vendor\": \"Explorance\", \"product\": \"Blue\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"8.14.12\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unaffected\"}], \"references\": [{\"url\": \"https://www.explorance.com/products/blue\", \"tags\": [\"product\"]}, {\"url\": \"https://online-help.explorance.com/blue/articles/security-advisories-(january-2026)\", \"tags\": [\"vendor-advisory\"]}, {\"url\": \"https://online-help.explorance.com/blue/articles/security-advisory:-cve-2025-57796\", \"tags\": [\"vendor-advisory\"]}, {\"url\": \"https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2026/MNDT-2026-0005.md\", \"tags\": [\"third-party-advisory\"]}], \"x_generator\": {\"engine\": \"Vulnogram 0.5.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"Explorance Blue versions prior to 8.14.12 use reversible symmetric encryption with a hardcoded static key to protect sensitive data, including user passwords and system configurations. This approach allows stored values to be decrypted offline if the encrypted data are obtained.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"Explorance Blue versions prior to 8.14.12 use reversible symmetric encryption with a hardcoded static key to protect sensitive data, including user passwords and system configurations. This approach allows stored values to be decrypted offline if the encrypted data are obtained.\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-257\", \"description\": \"CWE-257:Storing Passwords in a Recoverable Format\"}]}], \"providerMetadata\": {\"orgId\": \"027e81ed-0dd4-4685-ab4d-884aec5bb484\", \"shortName\": \"Mandiant\", \"dateUpdated\": \"2026-01-28T17:49:50.244Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2025-57796\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-01-28T18:11:13.946Z\", \"dateReserved\": \"2025-08-19T19:08:41.742Z\", \"assignerOrgId\": \"027e81ed-0dd4-4685-ab4d-884aec5bb484\", \"datePublished\": \"2026-01-28T17:47:56.607Z\", \"assignerShortName\": \"Mandiant\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2025-57796

Vulnerability from fkie_nvd - Published: 2026-01-28 18:16 - Updated: 2026-06-17 09:43

Severity

6.8 (Medium) - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

Summary

References

URL	Tags
mandiant-cve@google.com	https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2026/MNDT-2026-0005.md	Third Party Advisory
mandiant-cve@google.com	https://online-help.explorance.com/blue/articles/security-advisories-(january-2026)	Vendor Advisory
mandiant-cve@google.com	https://online-help.explorance.com/blue/articles/security-advisory:-cve-2025-57796	Vendor Advisory
mandiant-cve@google.com	https://www.explorance.com/products/blue	Product

Impacted products

	Vendor	Product	Version
	explorance	blue	*

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Blue",
          "vendor": "Explorance",
          "versions": [
            {
              "lessThan": "8.14.12",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "source": "mandiant-cve@google.com"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:explorance:blue:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "4DE2E7BA-5E00-494C-9737-45F26E3384F2",
              "versionEndExcluding": "8.14.12",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Explorance Blue versions prior to 8.14.12 use reversible symmetric encryption with a hardcoded static key to protect sensitive data, including user passwords and system configurations. This approach allows stored values to be decrypted offline if the encrypted data are obtained."
    },
    {
      "lang": "es",
      "value": "Las versiones de Explorance Blue anteriores a la 8.14.12 utilizan cifrado sim\u00e9trico reversible con una clave est\u00e1tica codificada de forma r\u00edgida para proteger datos sensibles, incluyendo contrase\u00f1as de usuario y configuraciones del sistema. Este enfoque permite que los valores almacenados sean descifrados sin conexi\u00f3n si se obtienen los datos cifrados."
    }
  ],
  "id": "CVE-2025-57796",
  "lastModified": "2026-06-17T09:43:27.100",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 6.8,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "HIGH",
          "scope": "CHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.3,
        "impactScore": 4.0,
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-57796",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-01-28T18:10:56.263409Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-01-28T18:16:49.940",
  "references": [
    {
      "source": "mandiant-cve@google.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2026/MNDT-2026-0005.md"
    },
    {
      "source": "mandiant-cve@google.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://online-help.explorance.com/blue/articles/security-advisories-(january-2026)"
    },
    {
      "source": "mandiant-cve@google.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://online-help.explorance.com/blue/articles/security-advisory:-cve-2025-57796"
    },
    {
      "source": "mandiant-cve@google.com",
      "tags": [
        "Product"
      ],
      "url": "https://www.explorance.com/products/blue"
    }
  ],
  "sourceIdentifier": "mandiant-cve@google.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-257"
        }
      ],
      "source": "mandiant-cve@google.com",
      "type": "Secondary"
    }
  ]
}

GHSA-CC53-W5WM-253V

Vulnerability from github – Published: 2026-01-28 18:30 – Updated: 2026-01-28 21:31

Details

Severity

6.8 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2025-57796"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-257"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-01-28T18:16:49Z",
    "severity": "MODERATE"
  },
  "details": "Explorance Blue versions prior to 8.14.12 use reversible symmetric encryption with a hardcoded static key to protect sensitive data, including user passwords and system configurations. This approach allows stored values to be decrypted offline if the encrypted data are obtained.",
  "id": "GHSA-cc53-w5wm-253v",
  "modified": "2026-01-28T21:31:22Z",
  "published": "2026-01-28T18:30:49Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-57796"
    },
    {
      "type": "WEB",
      "url": "https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2026/MNDT-2026-0005.md"
    },
    {
      "type": "WEB",
      "url": "https://online-help.explorance.com/blue/articles/security-advisories-(january-2026)"
    },
    {
      "type": "WEB",
      "url": "https://online-help.explorance.com/blue/articles/security-advisory:-cve-2025-57796"
    },
    {
      "type": "WEB",
      "url": "https://www.explorance.com/products/blue"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2025-57796 (GCVE-0-2025-57796)

FKIE_CVE-2025-57796

GHSA-CC53-W5WM-253V

Tags

Sightings

Nomenclature

Related by attack behaviour