The vulnerability is a plaintext storage of a password in Crypttech’s Vatos DLP. By storing the credential in clear text, an attacker who can read the file or memory containing the password can reuse the domain credentials, enabling impersonation of legitimate users or unauthorized access to domain resources. This results in a direct compromise of authentication data and undermines both confidentiality and integrity of the system’s credential management.

Crypttech Crypto and Informatics Technologies Industry and Trade Inc.'s Vatos DLP, specifically all releases between version 1.1.176 (inclusive) and 1.1.242 (inclusive). Versions 1.1.243 and later are not affected.

With a CVSS score of 7.1, the flaw carries a medium‑to‑high severity. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog, indicating no widespread exploitation reported to date. The likely attack vector is a combination of local or remote information disclosure, for example by reading the configuration file, accessing a network share, or exploiting an administrative interface that exposes the stored credential. Given the potential for credential theft and subsequent privilege escalation, it requires immediate remediation.