The Avantra application, when resetting passwords, transmits the new credentials unencrypted across the network. This flaw allows an attacker who can monitor traffic to capture valid user passwords, which can be used to gain unauthorized access to the system. The weakness is classified as CWE‑523, reflecting unprotected credential transport.

Syslink Software AG Avantra running on Linux or Windows with versions earlier than 25.3.0 is affected.

The CVSS score of 5.9 indicates moderate severity, and the lack of an EPSS score or KEV listing suggests limited known exploitation. However, the vulnerability remains exploitable through passive network monitoring, giving attackers direct access to user passwords without the need for additional exploits.