CVE-2026-45787Disclosure(electerm_project / electerm)

LOWCVSS 9.1 · CRITICAL

Signal is active with 3 mentions in latest observed window

Immediate actions

  • Patch electerm_project electerm systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to 3.9.5, deterministic AES-192-CBC with a fixed zero IV, constant KDF salt, and no MAC leads to confidentiality and integrity failures for synced bookmark/profile data. Attackers can crack common passwords across installs and perform undetected ciphertext bit-flips to alter config/bookmarks. This vulnerability is fixed in 3.9.5.

0.5/ 10 priority

Sources & remediation

Weakness type (CWE)
CWE-326CWE-329CWE-353CWE-759CWE-916

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • electerm

Threat summary

  • Patch or workaround signal is available
  • 3 mentions across 1 observed day

What's happening

  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 2 signals
  • Disclosure: 3 classified signals
  • 3 total mentions across 1 day

Affected systems

Products
electerm

Deep dive

Activity timeline3 mentions / 1d
01223Mentions · 2026-05-28: 3Patch / Workaround · 2026-05-28: 1Technical Details · 2026-05-28: 205-28
Signal classification1 categories
Disclosure
3100.0%
Referenced assets3 URLs
Full discourse3 posts
  • Vulmon Vulnerability Feed@VulmonFeeds
    Disclosure

    CVE-2026-45787 Cryptographic Weakness in Electerm Prior to 3.9.5 Enables Data Tampering https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-45787

    Post summary

    A cryptographic weakness in Electerm prior to 3.9.5 has been disclosed as CVE-2026-45787, enabling data tampering, but the announcement provides no PoC, exploit, patch, or active exploitation details.

    0000048
    4.0K followersView on X
  • Infoflowcloud@infoflowcloud
    Disclosure

    🚨*CVE* CVE-2026-45787 electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to 3.9.5, deterministic AES-192-CBC with a fixed zero IV, constant KDF… https://www.cve.org/CVERecord?id=CVE-2026-45787 ----- Traducción: CVE-2026-45787 ele… http://infoflow.cloud`

    Post summary

    The post announces CVE-2026-45787, detailing a deterministic AES‑192‑CBC flaw in electerm before v3.9.5, but does not provide PoCs, exploits, patches, or evidence of active exploitation.

    0000037
    79 followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2026-45787 electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to 3.9.5, deterministic AES-192-CBC with a fixed zero IV, constant KDF… https://www.cve.org/CVERecord?id=CVE-2026-45787

    Post summary

    The post describes CVE-2026-45787 as a cryptographic flaw in electerm before version 3.9.5, noting deterministic AES-192-CBC with a fixed IV, and links to the official CVE record.

    00000180
    57.5K followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Appelecterm_projectelecterm---

Explore more