A flaw in the sar2html.py script allows an attacker to manipulate the SECRET_KEY argument, causing hard‑coded credentials to be exposed. The vulnerability enables remote exploitation without local code execution prerequisites, potentially granting access to data or operations protected by those credentials.

The vulnerability affects the cemtan Sar2html application, version 4.0.0. The specific file impacted is sar2html.py, and the issue arises from its handling of the SECRET_KEY argument. No additional versions or products are listed in the current data.

The CVSS score of 6.9 indicates a medium risk. EPSS is unavailable, so we cannot quantify current exploitation likelihood, and the vulnerability is not present in the CISA KEV catalog. Because the attack can be executed remotely, a threat actor with network access to a Sar2html deployment could extract the hard‑coded credentials, leading to potential unauthorized data access or manipulation of the application’s behavior.