CVE-2026-75135

Katalog CVE

CVSS 6.1 · Medium EPSS 0,10%

Kerentanan Cleartext Storage of Sensitive Information in Memory. Skor CVSS 3.1 6.1 (Medium) menurut vulncheck.com.

Deskripsi (NVD)

UpSignOn for Windows before 7.19.0 contains a sensitive data exposure vulnerability that allows local attackers to recover the master password and decrypt vault contents by reading a retained backup key from the process memory of UpSignOn.exe, even after the vault has been re-locked. Attackers can extract the backup key from process memory to decrypt the encrypted master password backup stored in v6-vault1.DATA.txt, then use the recovered master password to decrypt the main vault and export all password manager entries in cleartext.

Rincian

Terbit di NVD

2 September 2026

Terakhir diubah

8 September 2026

Status NVD

Deferred

CVSS 3.1

6.1 (Medium), sumber vulncheck.com
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-316: Cleartext Storage of Sensitive Information in Memory

EPSS (30 hari)

0,10% peluang dieksploitasi; lebih tinggi dari 0,7% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://upsignon.eu/en/resources/release-notes/app#7.19.0
• https://www.vulncheck.com/advisories/upsignon-sensitive-key-retention-in-memory