The vulnerability arises from the use of a reversible XOR‑based mechanism to store password hashes in the SH3 system. Because the algorithm provides insufficient computational effort, attacker may recover plaintext passwords if they obtain the stored hashes. This compromises user credential confidentiality and could enable further access to the system.

The affected vendor is SH3 and the product is the SH3 system, specifically the Módulo de Gestão/Módulo de Arrecadação component. The exact versions impacted are unknown, but the vendor recommends upgrading to version 2026.0.2.0 to eliminate the weakness. No other affected versions are listed in the available data.

The CVSS score of 2.1 indicates a low severity vulnerability, and the EPSS score is not available. The vulnerability can be exploited remotely, but the attack requires a high degree of complexity and is reported as difficult. Because the exploit is disclosed publicly, attackers may attempt to recover passwords if they can retrieve the hashes. The risk remains low at present, and the vulnerability is not catalogued in CISA KEV. Operators should consider the likelihood of exploitation to determine whether to patch or to implement compensating controls.