Electerm encrypts synced bookmark and profile data using a deterministic AES‑192‑CBC cipher with a fixed zero IV, a constant KDF salt, and no MAC. The lack of randomness and integrity protection means an attacker who can read or manipulate the encrypted data can recover the plaintext with common passwords and silently modify configuration entries through bit‑flips, resulting in both confidentiality loss and integrity violations of user data.

The affected product is Electerm, the open‑source terminal client. Versions prior to 3.9.5 are impacted, regardless of the operating system on which the client runs, because the cryptographic flaw is in the core encryption routines.

The CVSS score of 6.0 rates this flaw as moderate, and the EPSS score is not available. It is also not in the CISA KEV catalog. Exploitation requires an attacker that can read or supply the encrypted configuration; the deterministic nature of the cipher makes brute‑force cracking of common passwords feasible, and bit‑flipping can be performed without detection. The likely attack vector is a local or remote attacker with sufficient privileges to access the client’s profile data, or an adversary who exploits another weakness that allows them to alter the stored messages.