CVE-2025-8095criticalCWE-257

CVE-2025-8095: falha crítica em Progress Software Corporation OpenEdge

Recoverable obfuscation using the OECH1 prefix encoding in OpenEdge

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar OpenEdge

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

28Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 9.1epss 0.2%
The OECH1 prefix encoding is intended to obfuscate values across the OpenEdge platform.  It has been identified as cryptographically weak and unsuitable for stored encodings and enterprise applications.  OECH1 encodings should be considered exploitable and immediately replaced by any other supported prefix encoding, all of which are based on symmetric encryption.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:U/AU:Y/V:D/RE:M/U:Red
Produtos afetados
Progress Software Corporation · OpenEdge
CVEs relacionadas — Progress Software Corporation OpenEdge

No mesmo produto, das mais perigosas para as menos.

CVE-2025-7388HIGHAuthenticated Command Injection via configuration parameter manipulation in exposed RMI interfaceEPSS 1.0%CVE-2023-40052HIGHProgress Application Server (PAS) for OpenEdge Denial of ServiceEPSS 0.6%CVE-2023-40051CRITICALProgress Application Server (PAS) for OpenEdge File Upload via Directory TraversalEPSS 0.6%CVE-2025-7389HIGHUnauthorized Arbitrary File Read via RMI in AdminServer InterfaceEPSS 0.3%