The vulnerability resides in the HostKeyServiceImpl.encryptKey method of dromara orion‑visor, where a hard‑coded AES key is used for encryption. An attacker can exploit this to decrypt saved SSH private keys and host passwords, compromising the confidentiality of credentials stored by the system. The weakness corresponds to the CWE‑320 and CWE‑321 classes of cryptographic practice issues. No known mechanisms exist in the product to invalidate or rotate the key, so the risk remains as long as the vulnerable version is in use.

All installations of dromara orion‑visor up to version 2.5.7 are affected. The specific component is orion‑visor-modules/orion‑visor-module‑asset/orion‑visor‑module‑asset‑service/src/main/java/org/dromara/visor/module/asset/service/impl/HostKeyServiceImpl.java. Users of these versions should review their deployment to verify whether the hard‑coded key is present.

The CVSS score of 6.9 indicates moderate severity. The EPSS score is not available, so the likelihood of exploitation cannot be quantified, but the vulnerability is publicly disclosed and can be performed remotely. The vendor has not issued a fix yet, so the vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be remote, as the description states that exploitation can be carried out remotely. Based on the available data, the overall risk is moderate to high for environments where SSH keys or host passwords are stored by orion‑visor.