CVE-2026-35097

MEDIUM

Weak Password Requirements in KTM System e-BOK

Title source: cna
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2026-35097. PoCs published by HermesNA-1.

AI-analyzed exploit summary This repository contains an auto-generated stub module for CVE-2026-35097, a weak password policy vulnerability in KTM System e-BOK. The code includes placeholder methods (`check` and `run`) but lacks actual exploit implementation, referencing external sources for details.

Description

KTM System e-BOK enforces a maximum password length of six numeric digits and does not permit the use of any alphabetic, special, or extended characters. This issue was fixed in the patch published in June 2026.

Exploits (1)

github STUB 1 stars
by HermesNA-1 · pythonpoc
https://github.com/HermesNA-1/SnakeSploit/tree/main/data/modules_generated/cve-2026-35097_ktm_system_e-bok.py

This repository contains an auto-generated stub module for CVE-2026-35097, a weak password policy vulnerability in KTM System e-BOK. The code includes placeholder methods (`check` and `run`) but lacks actual exploit implementation, referencing external sources for details.

Classification
Stub 99%
Attack Type
Auth Bypass
Complexity
Moderate
Reliability
Theoretical
Target: KTM System e-BOK (version not specified)
No auth needed
Prerequisites: Network access to the target system (RHOSTS:RPORT) · Knowledge of the weak password policy (6-digit numeric only)
mistral-large-3 · analyzed Jul 09, 2026 Full analysis →

References (2)

Core 2
Core References
Third Party Advisory third-party-advisory
https://cert.pl/posts/2026/06/CVE-2026-35095/

Scores

CVSS v4 6.9
EPSS 0.0025
EPSS Percentile 16.3%
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact partial

Details

CWE
CWE-521
Status published
Products (1)
KTM System/e-BOK < 06.2026
Published Jun 30, 2026
Tracked Since Jun 30, 2026