CVE-2025-13175 Insecure Password Storage in Y Soft SafeQ 6
Administrators can reveal stored Workflow Connector passwords via browser tools, exposing sensitive credentials in Y Soft SafeQ 6.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-13175?
CVE-2025-13175 is a medium-severity vulnerability in YSoft SafeQ 6, published on 14 Jan 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Y Soft SafeQ 6 renders the Workflow Connector password field in a way that allows an administrator with UI access to reveal the value using browser developer/inspection tools. The affected customers are only those with a password-protected scan workflow connector. This issue affects Y Soft SafeQ 6 in versions before MU106.
Weakness: CWE-549
Which versions are affected by CVE-2025-13175?
How do I fix CVE-2025-13175?
No fix has been published for CVE-2025-13175 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-13175 being exploited?
There is no known exploitation of CVE-2025-13175 in the wild and no public exploit code.
Sources
Also known as GHSA-h59v-x7wr-gq9p.