CVE-2026-25600 (GCVE-0-2026-25600)

Vulnerability from cvelistv5 – Published: 2026-06-01 09:37 – Updated: 2026-06-01 13:01
VLAI
Title
Credential Exposure Vulnerability in Trac PDBM
Summary
The PDBM application relies on a static, hard‑coded secret embedded in the PDBM.exe executable. This secret is used by the application’s encryption routines, including the function responsible for decrypting credentials stored in the product’s configuration file. Because the secret is constant across installations, any attacker with sufficient local privileges can extract it from the binary. Once obtained, the secret allows the attacker to decrypt the stored password and authenticate as the user defined in the configuration file. In the affected version, this user account is configured with administrative privileges, granting full access to PDBM’s management interface and its underlying operational functions.
Severity
6.4 (Medium)
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
Assigner
References
URL Tags
https://www.cert.si/en/cve-2026-25600/ third-party-advisory
Impacted products
Vendor Product Version
Trac d.o.o. PDBM Affected: 0 , < 2.0.0.0 (semver)
Create a notification for this product.
Credits
Mijo Mišić, Combis d.o.o.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-25600",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-01T13:01:42.272560Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-01T13:01:53.235Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "PDBM",
          "vendor": "Trac d.o.o.",
          "versions": [
            {
              "lessThan": "2.0.0.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Mijo Mi\u0161i\u0107, Combis d.o.o."
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe PDBM application relies on a static, hard\u2011coded secret embedded \nin the PDBM.exe executable. This secret is used by the application\u2019s \nencryption routines, including the function responsible for decrypting \ncredentials stored in the product\u2019s configuration file. Because the \nsecret is constant across installations, any attacker with sufficient \nlocal privileges can extract it from the binary. Once obtained, the secret allows the attacker to decrypt the stored \npassword and authenticate as the user defined in the configuration file.\n In the affected version, this user account is configured with \nadministrative privileges, granting full access to PDBM\u2019s management \ninterface and its underlying operational functions.\u003c/p\u003e"
            }
          ],
          "value": "The PDBM application relies on a static, hard\u2011coded secret embedded \nin the PDBM.exe executable. This secret is used by the application\u2019s \nencryption routines, including the function responsible for decrypting \ncredentials stored in the product\u2019s configuration file. Because the \nsecret is constant across installations, any attacker with sufficient \nlocal privileges can extract it from the binary. Once obtained, the secret allows the attacker to decrypt the stored \npassword and authenticate as the user defined in the configuration file.\n In the affected version, this user account is configured with \nadministrative privileges, granting full access to PDBM\u2019s management \ninterface and its underlying operational functions."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 6.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-798",
              "description": "CWE-798",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-01T09:37:48.852Z",
        "orgId": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158",
        "shortName": "ENISA"
      },
      "references": [
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.cert.si/en/cve-2026-25600/"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Credential Exposure Vulnerability in Trac PDBM",
      "x_generator": {
        "engine": "Vulnogram 1.0.2"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158",
    "assignerShortName": "ENISA",
    "cveId": "CVE-2026-25600",
    "datePublished": "2026-06-01T09:37:48.852Z",
    "dateReserved": "2026-02-03T07:24:49.547Z",
    "dateUpdated": "2026-06-01T13:01:53.235Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-25600",
      "date": "2026-06-02",
      "epss": "7e-05",
      "percentile": "0.00529"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-25600\",\"sourceIdentifier\":\"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158\",\"published\":\"2026-06-01T11:16:24.793\",\"lastModified\":\"2026-06-01T18:02:29.343\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"The PDBM application relies on a static, hard\u2011coded secret embedded \\nin the PDBM.exe executable. This secret is used by the application\u2019s \\nencryption routines, including the function responsible for decrypting \\ncredentials stored in the product\u2019s configuration file. Because the \\nsecret is constant across installations, any attacker with sufficient \\nlocal privileges can extract it from the binary. Once obtained, the secret allows the attacker to decrypt the stored \\npassword and authenticate as the user defined in the configuration file.\\n In the affected version, this user account is configured with \\nadministrative privileges, granting full access to PDBM\u2019s management \\ninterface and its underlying operational functions.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":6.4,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"HIGH\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":0.5,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-798\"}]}],\"references\":[{\"url\":\"https://www.cert.si/en/cve-2026-25600/\",\"source\":\"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-25600\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-06-01T13:01:42.272560Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-06-01T13:01:49.698Z\"}}], \"cna\": {\"title\": \"Credential Exposure Vulnerability in Trac PDBM\", \"source\": {\"discovery\": \"UNKNOWN\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"Mijo Mi\\u0161i\\u0107, Combis d.o.o.\"}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 6.4, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"HIGH\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"HIGH\", \"confidentialityImpact\": \"HIGH\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"vendor\": \"Trac d.o.o.\", \"product\": \"PDBM\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"2.0.0.0\", \"versionType\": \"semver\"}], \"defaultStatus\": \"unaffected\"}], \"references\": [{\"url\": \"https://www.cert.si/en/cve-2026-25600/\", \"tags\": [\"third-party-advisory\"]}], \"x_generator\": {\"engine\": \"Vulnogram 1.0.2\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"The PDBM application relies on a static, hard\\u2011coded secret embedded \\nin the PDBM.exe executable. This secret is used by the application\\u2019s \\nencryption routines, including the function responsible for decrypting \\ncredentials stored in the product\\u2019s configuration file. Because the \\nsecret is constant across installations, any attacker with sufficient \\nlocal privileges can extract it from the binary. Once obtained, the secret allows the attacker to decrypt the stored \\npassword and authenticate as the user defined in the configuration file.\\n In the affected version, this user account is configured with \\nadministrative privileges, granting full access to PDBM\\u2019s management \\ninterface and its underlying operational functions.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eThe PDBM application relies on a static, hard\\u2011coded secret embedded \\nin the PDBM.exe executable. This secret is used by the application\\u2019s \\nencryption routines, including the function responsible for decrypting \\ncredentials stored in the product\\u2019s configuration file. Because the \\nsecret is constant across installations, any attacker with sufficient \\nlocal privileges can extract it from the binary. Once obtained, the secret allows the attacker to decrypt the stored \\npassword and authenticate as the user defined in the configuration file.\\n In the affected version, this user account is configured with \\nadministrative privileges, granting full access to PDBM\\u2019s management \\ninterface and its underlying operational functions.\u003c/p\u003e\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-798\", \"description\": \"CWE-798\"}]}], \"providerMetadata\": {\"orgId\": \"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158\", \"shortName\": \"ENISA\", \"dateUpdated\": \"2026-06-01T09:37:48.852Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-25600\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-06-01T13:01:53.235Z\", \"dateReserved\": \"2026-02-03T07:24:49.547Z\", \"assignerOrgId\": \"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158\", \"datePublished\": \"2026-06-01T09:37:48.852Z\", \"assignerShortName\": \"ENISA\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.