A hardcoded cryptographic key in the component used by MEPIS RM encrypts domain passwords when the store‑password option is turned on. If an attacker can read the application database, the embedded key allows decryption of those credentials, exposing the usernames and passwords that give access to the connected industrial control environment. The vulnerability is a classic credential‑exposure flaw classified under CWE‑798.

Metronik’s MEPIS RM software, particularly version 8.2.0007 and any builds that retain the same hardcoded key, are affected. The flaw applies whenever the feature to store domain passwords is enabled, regardless of the specific operator or deployment environment.

The weakness carries a CVSS score of 6.4, indicating a moderate severity that is likely exploitable only if an attacker obtains database access or local administrative rights. The probability of exploitation is currently below 1 %. The issue is not listed in the CISA Known Exploited Vulnerabilities catalog, but it provides a clear pathway for privilege escalation: read encrypted credentials, use the embedded key, and unmask passwords, thus enabling unauthorized control of the affected OT systems.