Description
electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to 3.9.5, deterministic AES-192-CBC with a fixed zero IV, constant KDF salt, and no MAC leads to confidentiality and integrity failures for synced bookmark/profile data. Attackers can crack common passwords across installs and perform undetected ciphertext bit-flips to alter config/bookmarks. This vulnerability is fixed in 3.9.5.
References (2)
Core 2
Core References
X_Refsource_Confirm x_refsource_confirm
https://github.com/electerm/electerm/security/advisories/GHSA-g29v-q6h7-76wh
X_Refsource_Misc x_refsource_misc
https://github.com/electerm/electerm/commit/9dd8295e37d53396b980cd45dfc5ed11ad79b937
Scores
CVSS v3
9.1
EPSS
0.0010
EPSS Percentile
1.3%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
partial
Details
CWE
CWE-326
CWE-329
CWE-353
CWE-759
CWE-916
Status
published
Products (3)
electerm/electerm
< 3.9.5
electerm_project/electerm
< 3.9.5
npm/electerm
0 - 3.9.5npm
Published
May 28, 2026
Tracked Since
May 28, 2026