CVE-2026-25608: Lack of traffic encryption in STER

Severity: low (CVSS 2.3 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-05-22 · updated 2026-07-23
Weakness: CWE-319

Description

STER uses unencrypted TCP traffic to transmit data over the network. It allows an attacker to conduct a Man-In-The-Middle attack and obtain sensitive data such as passwords, personal data, or authentication tokens. This issue was fixed in version 9.5.

Affected products

Centralny Instytut Ochrony Pracy - Państwowy Instytut Badawczy STER: before 9.5 — fixed in 9.5

How to fix

Upgrade to a fixed version: Centralny Instytut Ochrony Pracy - Państwowy Instytut Badawczy STER 9.5. Check the vendor advisory for mitigations.

References

https://cert.pl/posts/2026/05/CVE-2026-25606
https://www.ciop.pl/CIOPPortalWAR/appmanager/ciop/pl?_nfpb=true&_pageLabel=P52000165211572544981480

Get alerted when CVE-2026-25608 or the next vulnerability affects your stack