CVE-2026-25601 Credential Exposure vulnerability in MEPIS RM
Hardcoded cryptographic key allows decryption of stored domain passwords, enabling unauthorized access to ICS/OT environments.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-25601?
CVE-2026-25601 is a medium-severity vulnerability in Metronik d.o.o. MEPIS RM, published on 1 Apr 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A vulnerability was identified in MEPIS RM, an industrial software product developed by Metronik. The application contained a hardcoded cryptographic key within the Mx.Web.ComponentModel.dll component. When the option to store domain passwords was enabled, this key was used to encrypt user passwords before storing them in the application’s database. An attacker with sufficient privileges to access the database could extract the encrypted passwords, decrypt them using the embedded key, and gain unauthorized access to the associated ICS/OT environment.
Weakness: CWE-798
Which versions are affected by CVE-2026-25601?
It affects 1 product.
Products include Metronik Mepis Rm.
How do I fix CVE-2026-25601?
No fix has been published for CVE-2026-25601 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-25601 being exploited?
There is no known exploitation of CVE-2026-25601 in the wild and no public exploit code.
Sources
Also known as GHSA-p32r-2rg5-6gc2.