What’s Vulnerable › Vulnerabilities

CVE-2026-45787: electerm's encrypt method not safe enough

• Severity: critical (CVSS 9.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-05-28 · updated 2026-06-17
• Weakness: CWE-326

Description

electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to 3.9.5, deterministic AES-192-CBC with a fixed zero IV, constant KDF salt, and no MAC leads to confidentiality and integrity failures for synced bookmark/profile data. Attackers can crack common passwords across installs and perform undetected ciphertext bit-flips to alter config/bookmarks. This vulnerability is fixed in 3.9.5.

Affected products

• electerm: before 3.9.5 — fixed in 3.9.5

How to fix

Upgrade to a fixed version: electerm 3.9.5. Check the vendor advisory for mitigations.

References

• https://github.com/electerm/electerm/commit/9dd8295e37d53396b980cd45dfc5ed11ad79b937
• https://github.com/electerm/electerm/security/advisories/GHSA-g29v-q6h7-76wh

Get alerted when CVE-2026-45787 or the next vulnerability affects your stack