Trac d.o.o. PDBM Hardcoded Credential Vulnerability CVE-2026-25600

Vulnerability Overview CVE ID: CVE-2026-25600 Vulnerability Type: Credential Exposure Affected Product: PDBM (Process Database Manager) by Trac d.o.o. Description: The PDBM application embeds cryptographic secrets within a static, hard-coded key used for the application’s encryption and decryption routines. Attackers can decrypt administrator passwords stored in configuration files by extracting this key, thereby gaining full access to the PDBM administrative interface and its underlying operational functions. Impact Scope Affected Version: PDBM 1.0.0.0 CVSS Score: 6.4 (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) CWE ID: CWE-798: Use of Hardcoded Credentials Impact: Attackers can exploit this vulnerability to obtain administrator credentials, enabling unauthorized operations on the PDBM application and its connected ICS/OT environment. This may lead to the manipulation of industrial processes, operational disruptions, or lateral movement within critical infrastructure networks. Remediation Fixed Version: PDBM 2.0.0.0 Remediation Measures: Starting with version 2.0.0.0, the application no longer includes a hard-coded key; instead, it utilizes a hash-based authentication mechanism. Additional Recommendations: - Access Control: Ensure that access to the application environment and configuration files is restricted to authorized personnel only. - Monitoring: Implement monitoring and logging capabilities to detect unauthorized access attempts or suspicious activities. Timeline January 15, 2026: Initial report submitted to SI-CERT. January 21, 2026: Vulnerability researcher provided detailed technical information regarding the identified issue. February 3, 2026: Formal notification sent to the vendor. May 29, 2026: Advisory published. Acknowledgments Discoverer: Miho Mišić, Penetration Tester at Combis d.o.o., Croatia. Contact Information SI-CERT Address: ARNES, Tehnološki park 18, 1000 Ljubljana Phone: +386 1 479 88 00 Email: info@cert.si Additional Related Information Related Vulnerabilities: - CVE-2026-25599: Missing authentication and plaintext data transmission in Orca heat pumps. - CVE-2025-42611: Authentication bypass in RouterOS services. - VANTAGE: Global enhanced test automation vulnerability assessment. Code Snippet No Proof of Concept (PoC) code or exploit code is included in this document.

Goal Reached Thanks to every supporter — we hit 100%!

Trac d.o.o. PDBM Hardcoded Credential Vulnerability CVE-2026-25600

More from this source