CVE-2025-57796

Explorance Blue versions prior to 8.14.12 use reversible symmetric encryption with a hardcoded static key to protect sensitive data, including user passwords and system configurations. This approach allows stored values to be decrypted offline if the encrypted data are obtained.

CVSS v3 6.8 MEDIUM

6.8^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.3 / Impact : 4.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2026/MNDT-2026-0005.md	Third Party Advisory
https://online-help.explorance.com/blue/articles/security-advisories-(january-2026)	Vendor Advisory
https://online-help.explorance.com/blue/articles/security-advisory:-cve-2025-57796	Vendor Advisory
https://www.explorance.com/products/blue	Product

Configurations

Configuration 1 (hide)

cpe:2.3:a:explorance:blue:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2026-01-28 18:16

Updated : 2026-06-17 09:43

NVD link : CVE-2025-57796

Mitre link : CVE-2025-57796

CVE.ORG link : CVE-2025-57796

JSON object : View

Products Affected

explorance

blue

CWE

CWE-257

Storing Passwords in a Recoverable Format

{"id": "CVE-2025-57796", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-57796", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-28T18:10:56.263409Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 4.0, "exploitabilityScore": 2.3}]}, "affected": [{"source": "mandiant-cve@google.com", "affectedData": [{"vendor": "Explorance", "product": "Blue", "versions": [{"status": "affected", "version": "0", "lessThan": "8.14.12", "versionType": "custom"}], "defaultStatus": "unaffected"}]}], "published": "2026-01-28T18:16:49.940", "references": [{"url": "https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2026/MNDT-2026-0005.md", "tags": ["Third Party Advisory"], "source": "mandiant-cve@google.com"}, {"url": "https://online-help.explorance.com/blue/articles/security-advisories-(january-2026)", "tags": ["Vendor Advisory"], "source": "mandiant-cve@google.com"}, {"url": "https://online-help.explorance.com/blue/articles/security-advisory:-cve-2025-57796", "tags": ["Vendor Advisory"], "source": "mandiant-cve@google.com"}, {"url": "https://www.explorance.com/products/blue", "tags": ["Product"], "source": "mandiant-cve@google.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "mandiant-cve@google.com", "description": [{"lang": "en", "value": "CWE-257"}]}], "descriptions": [{"lang": "en", "value": "Explorance Blue versions prior to 8.14.12 use reversible symmetric encryption with a hardcoded static key to protect sensitive data, including user passwords and system configurations. This approach allows stored values to be decrypted offline if the encrypted data are obtained."}, {"lang": "es", "value": "Las versiones de Explorance Blue anteriores a la 8.14.12 utilizan cifrado sim\u00e9trico reversible con una clave est\u00e1tica codificada de forma r\u00edgida para proteger datos sensibles, incluyendo contrase\u00f1as de usuario y configuraciones del sistema. Este enfoque permite que los valores almacenados sean descifrados sin conexi\u00f3n si se obtienen los datos cifrados."}], "lastModified": "2026-06-17T09:43:27.100", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:explorance:blue:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4DE2E7BA-5E00-494C-9737-45F26E3384F2", "versionEndExcluding": "8.14.12"}], "operator": "OR"}]}], "sourceIdentifier": "mandiant-cve@google.com"}