CVE-2026-45787

electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to 3.9.5, deterministic AES-192-CBC with a fixed zero IV, constant KDF salt, and no MAC leads to confidentiality and integrity failures for synced bookmark/profile data. Attackers can crack common passwords across installs and perform undetected ciphertext bit-flips to alter config/bookmarks. This vulnerability is fixed in 3.9.5.

Scoring

Severity

MEDIUM

CVSS base score

6

CVSS vector

CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

EPSS probability

0.10%

CWE

CWE-326, CWE-329, CWE-353, CWE-759, CWE-916

Published

2026-05-28

Last modified

2026-05-29

Affected products

• electerm electerm

Weakness type

• CWE-326
• CWE-329
• CWE-353
• CWE-759
• CWE-916

Related vulnerabilities

• CVE-2026-86670 — aircheng-org iWebShop-5 Authentication Storage admin.php weak password hash
• CVE-2023-54356 — Kyverno before 1.9.5 Sweet32 Medium Strength Cipher Suites
• CVE-2026-81718 — openssl_encrypt before 1.4.9 Weak Cryptographic Parameters
• CVE-2026-79084 — Inadequate encryption strength in Notifications in Google Chrome on on Windows prior to...
• CVE-2026-74889 — openssl_encrypt before 1.4.0 Weak Key Derivation via HKDF
• CVE-2026-65777 — Active Directory Security Feature Bypass Vulnerability
• CVE-2026-9201 — Langflow OSS is affected by arbitrary code execution in component generation, validation, and custom component handling
• CVE-2026-59651 — BKS keystore accepts legacy version with 16-bit integrity MAC key

Markdown version · Browse all CVEs