CVE-2026-35097

Weak Password Requirements in KTM System e-BOK

CVSS 6.9 MEDIUMEPSS 0.2%CWE-521

Vexday Risk Score

13Bajo

Decisión SSVC (CISA)

Track

Sin señal de explotación → monitorear

CVSS 6.9EPSS 0.2%KEV nãoPoC —Nuclei —Metasploit —Patch —

Ciclo de vida

30 jun 2026Publicada en NVD

Recomendación: Monitorear — sin señal de explotación por ahora.

KTM System e-BOK enforces a maximum password length of six numeric digits and does not permit the use of any alphabetic, special, or extended characters. This issue was fixed in the patch published in June 2026.

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Productos afectados

KTM System · e-BOK

Referencias

https://cert.pl/posts/2026/06/CVE-2026-35095/https://ktmsystem.pl/internetowe-biuro-obslugi-klienta/