CVE-2026-25608

Vulnerability

STER, the Computer System Supporting Occupational Safety and Health Management, transmits data over the network using unencrypted TCP traffic. All versions below 9.5 are affected. This design weakness allows an attacker positioned on the network path to intercept communications without any additional configuration beyond network proximity [1].

Exploitation

An attacker with a Man-In-The-Middle (MITM) position on the network can capture unencrypted TCP traffic between the STER client and server. The attacker does not need authentication or user interaction beyond normal system operation. The plaintext data can be passively collected or actively relayed [1].

Impact

Successful exploitation enables the attacker to obtain sensitive data such as passwords, personal data, or authentication tokens. This results in a loss of confidentiality for all transmitted information, potentially leading to further compromise of user accounts or systems [1].

Mitigation

The vulnerability was fixed in STER version 9.5. All users should upgrade to version 9.5 or later to enforce encrypted communication. No workaround is available for earlier versions [1][2].