Credential Exposure vulnerability in MEPIS RM
Key facts
- Attack vector
- Local
- Privileges required
- High
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-798.
Summary
A vulnerability was identified in MEPIS RM, an industrial software product developed by Metronik. The application contained a hardcoded cryptographic key within the Mx.Web.ComponentModel.dll component. When the option to store domain passwords was enabled, this key was used to encrypt user passwords before storing them in the application’s database. An attacker with sufficient privileges to access the database could extract the encrypted passwords, decrypt them using the embedded key, and gain unauthorized access to the associated ICS/OT environment.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Metronik d.o.o. | MEPIS RM | before 8.2.0107; before 8.2.0007 build 15 | 8.2.0107, 8.2.0007 build 15 | Patch available | CNA |
- MEPIS RM VendorMetronik d.o.o. Affected before 8.2.0107; before 8.2.0007 build 15 Fixed in 8.2.0107, 8.2.0007 build 15 Patch available CNA
Remediation
- Fix · CNA MEPIS RM (Metronik d.o.o.) Fixed in 8.2.0107, 8.2.0007 build 15
Timeline
- 2026-10-02 Threatist record created from CVE-2026-25601
- 2026-10-03 Alias added: GHSA-p32r-2rg5-6gc2
References
Advisory 1
Sources
- CVE-2026-25601 · CVE Program
- CVE-2026-25601 · NVD
- FIRST EPSS
- GHSA-p32r-2rg5-6gc2 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences