CVE-2024-7407

EUVD-2024-54324 · Published Mar 28, 2025

Use of a custom password encoding algorithm in Streamsoft Prestiż software allows straightforward decoding of passwords using their encoded forms, which are stored in the application's database. One has to know the encoding algorithm, but it can be deduced by observing how password are transformed. This issue was fixed in 18.2.377 version of the software.

Weaknesses

CWE-261

CVSS scores

v4.08.2CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

MITRE ATT&CK

Inferred

Where this vulnerability fits in an attack

ReconImpact

Initial Access Credential Access

T1190Exploit Public-Facing Application T1110.002Password Cracking

References

https://cert.pl/en/posts/2025/03/CVE-2024-7407/
https://www.streamsoft.pl/streamsoft-prestiz/

Potentially impacted assets

See if this affects your attack surface