The vulnerability stems from STER's weak password encoding algorithm. By analyzing known plaintext passwords and their encoded forms, an attacker can deduce the original password value for any user. Successful exploitation leads to credential compromise, allowing the attacker to impersonate a legitimate user and gain unauthorized access to sensitive data or functionalities within the application.

The software affected is STER from Centralny Instytut Ochrony Pracy – Państwowy Instytut Badawczy. All releases before version 9.5 are vulnerable; the fix was introduced in 9.5.

The CVSS score of 5.7 denotes moderate severity. No EPSS score is provided, and it is not listed in CISA KEV, indicating that there is no confirmed widespread exploitation, but the flaw still presents a legitimate risk. The lack of explicit attack vector information means the vector is inferred as a software local attack, potentially via local compromise or remote exploitation if password data is exposed through the application. The primary risk is the potential unauthorized access to any accounts whose passwords can be reconstructed from the weak encoding.