Read the docs
TI-2025-36402 Aliases CVE-2025-58744GHSA-9259-996q-pvq8

Hard-Coded Default Credentials Enable Document Archive Decryption in Milner ImageDirector Capture

Priority LOW 29CWE-1392Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-798.

Summary

Use of Default Credentials, Hard-coded Credentials vulnerability in C2SGlobalSettings.dll in Milner ImageDirector Capture on Windows allows decryption of document archive files using credentials decrypted with hard-coded application encryption key. This issue affects ImageDirector Capture: from 7.0.9.0 before 7.6.3.25808.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00148 4th percentileScored 2026-11-07
Fix Fixed ImageDirector Capture (Milner): 7.6.3.25808

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
MilnerImageDirector Capture7.0.9.0 to before 7.6.3.258087.6.3.25808Patch availableCNA
  • ImageDirector Capture VendorMilner Affected 7.0.9.0 to before 7.6.3.25808 Fixed in 7.6.3.25808 Patch available CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:milner:imagedirector_capture:*:*:*:*:*:*:*:*7.0.9 to before 7.6.3.25808VulnerableMilner
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*not specified by NVDRunning onMicrosoft
  • cpe:2.3:a:milner:imagedirector_capture:*:*:*:*:*:*:*:* Versions 7.0.9 to before 7.6.3.25808 Vulnerable ·Milner
  • cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft

Remediation

  • Fix · CNA ImageDirector Capture (Milner) Fixed in 7.6.3.25808

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Milner ImageDirector Capture 7.6.3.25808

    4 records Highest priority Priority LOW 4 LOW

    Other records, highest priority first

    • TI-2025-36400 Insufficient Configuration Protections Enable Database Credential Interception in Milner ImageDirector CapturePriority LOW 36
    • TI-2025-36398 Hardcoded Encryption Key Enables Database Credential Access in Milner ImageDirector CapturePriority LOW 35
    • TI-2025-36401 Insecure Encryption Algorithms Enable Brute-Force Database Credential Access in Milner ImageDirector CapturePriority LOW 30
    Show all 4 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-58744
  2. 2026-10-03 Alias added: GHSA-9259-996q-pvq8

References

Advisory 1

  • TI-2025-36400 Insufficient Configuration Protections Enable Database Credential Interception in Milner ImageDirector Capture CVSS 4.0HIGH 8.5
  • TI-2025-36399 Insecure Masked Credential Fields Enable Database Credential Access in Milner ImageDirector Capture CVSS 4.0HIGH 8.5
  • TI-2025-36398 Hardcoded Encryption Key Enables Database Credential Access in Milner ImageDirector Capture CVSS 4.0HIGH 8.5
  • TI-2025-36401 Insecure Encryption Algorithms Enable Brute-Force Database Credential Access in Milner ImageDirector Capture CVSS 4.0HIGH 7.2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences