CVE-2026-90510 - Vulnerability Details

- dromara orion-visor HostKeyServiceImpl.java HostKeyServiceImpl.encryptKey hard-coded key

Description

A security vulnerability has been detected in dromara orion-visor up to 2.5.7. This affects the function HostKeyServiceImpl.encryptKey of the file orion-visor-modules/orion-visor-module-asset/orion-visor-module-asset-service/src/main/java/org/dromara/visor/module/asset/service/impl/HostKeyServiceImpl.java. The manipulation leads to use of hard-coded cryptographic key
. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.

Published: 2026-09-13

Score: 6.9 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The vulnerability resides in the HostKeyServiceImpl.encryptKey method of dromara orion‑visor, where a hard‑coded AES key is used for encryption. An attacker can exploit this weakness to decrypt SSH private keys and host passwords stored by the system, thus compromising the confidentiality of credentials. The flaw corresponds to the CWE‑320 and CWE‑321 classes of cryptographic practice issues.

Affected Systems

All installations of dromara orion‑visor up to version 2.5.7 are affected. The vulnerable component is orion‑visor‑modules/orion‑visor-module-asset/orion‑visor‑module-asset‑service/src/main/java/org/dromara/visor/module/asset/service/impl/HostKeyServiceImpl.java.

Risk and Exploitability

The CVSS score of 6.9 indicates moderate severity. The EPSS score is below 1%, pointing to a very low probability of exploitation, yet the vulnerability is already publicly disclosed and usable. The product has not released a patch at the time of analysis, so the vulnerability remains unmitigated. While the vulnerability is not listed in CISA KEV, that does not diminish the potential impact. Service operators using affected versions should consider that the possibility of credential compromise remains real and should plan remediation promptly.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

dromara

orion-visor

affected

Version	Status	Constraints
`2.5.0`	affected	—
`2.5.1`	affected	—
`2.5.2`	affected	—
`2.5.3`	affected	—
`2.5.4`	affected	—
`2.5.5`	affected	—
`2.5.6`	affected	—
`2.5.7`	affected	—

No data.

Vendor Product Confidence Versions

Dromara

Orion-visor

95%

Version	Status	Scheme	Platform
`2.5.0`	affected	semver	—
`2.5.1`	affected	semver	—
`2.5.2`	affected	semver	—
`2.5.3`	affected	semver	—
`2.5.4`	affected	semver	—
`2.5.5`	affected	semver	—
`2.5.6`	affected	semver	—
`2.5.7`	affected	semver	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade to the latest version of dromara orion‑visor that removes the hard‑coded key.
Restrict external network access to the Orion‑Visor management interface to trusted IPs or internal networks only.
If an upgrade is not feasible, modify the source code to replace the hard‑coded encryption key with a configurable key, rebuild, and redeploy the patched application.

Generated by OpenCVE AI on September 15, 2026 at 17:15 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact Low

Subsequent System Integrity Impact Low

Subsequent System Availability Impact Low

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

This CVE is not in the KEV list.

The EPSS score is 0.005.

Exploitation poc

Automatable yes

Technical Impact partial

References

Link	Providers
https://github.com/dromara/orion-visor/
https://github.com/dromara/orion-visor/issues/171
https://github.com/sumo166/CVE-apply/blob/main/dromara-orion-visor/Hardcoded%20AES%20Encryption%20Key%20Enables%20Decryption%20of%20SSH%20Private%20Keys%20and%20Host%20Passwords%20(CWE-321)_en.md
https://vuldb.com/cve/CVE-2026-90510
https://vuldb.com/submit/911865
https://vuldb.com/vuln/403098
https://vuldb.com/vuln/403098/cti

History

Mon, 14 Sep 2026 23:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Sun, 13 Sep 2026 10:30:00 +0000

Type	Values Removed	Values Added
Description		A security vulnerability has been detected in dromara orion-visor up to 2.5.7. This affects the function HostKeyServiceImpl.encryptKey of the file orion-visor-modules/orion-visor-module-asset/orion-visor-module-asset-service/src/main/java/org/dromara/visor/module/asset/service/impl/HostKeyServiceImpl.java. The manipulation leads to use of hard-coded cryptographic key . The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Title		dromara orion-visor HostKeyServiceImpl.java HostKeyServiceImpl.encryptKey hard-coded key
First Time appeared		Dromara Dromara orion-visor
Weaknesses		CWE-320 CWE-321
CPEs		cpe:2.3:a:dromara:orion-visor::::::::
Vendors & Products		Dromara Dromara orion-visor
References		https://github.com/dromara/orion-visor/ https://github.com/dromara/orion-visor/issues/171 https://github.com/sumo166/CVE-apply/blob/main/dromara-orion-visor/Hardcoded%20AES%20Encryption%20Key%20Enables%20Decryption%20of%20SSH%20Private%20Keys%20and%20Host%20Passwords%20(CWE-321)_en.md https://vuldb.com/cve/CVE-2026-90510 https://vuldb.com/submit/911865 https://vuldb.com/vuln/403098 https://vuldb.com/vuln/403098/cti
Metrics		cvssV2_0 `{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}` cvssV3_0 `{'score': 8.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L/E:P/RL:X/RC:R'}` cvssV3_1 `{'score': 8.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L/E:P/RL:X/RC:R'}` cvssV4_0 `{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:P'}`

Subscriptions

Dromara Orion-visor

MITRE

Status: PUBLISHED

Assigner: VulDB

Published: 2026-09-13T10:15:08.684Z

Updated: 2026-09-14T17:46:06.696Z

Reserved: 2026-09-12T08:58:31.850Z

Link: CVE-2026-90510

Vulnrichment

Updated: 2026-09-14T17:45:53.382Z

NVD

Status : Deferred

Published: 2026-09-13T11:16:59.827

Modified: 2026-09-14T20:56:48.220

Link: CVE-2026-90510

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-09-15T17:30:10Z

Weaknesses

CWE-320
CWE-321
Use of Hard-coded Cryptographic Key

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact Low

Subsequent System Integrity Impact Low

Subsequent System Availability Impact Low

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

Exploitation poc

Automatable yes

Technical Impact partial

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object