PT-2025-34143 · Elunez · Elunez Eladmin

Ez-Lbz · Published 2025-08-20 · Updated 2025-08-21 · CVE-2025-9239

Positive Technologies (AI Summary)

CVSS v4.0

6.3

Medium

Base vector

AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions: elunez eladmin versions prior to 2.8

Description: A vulnerability exists in the EncryptUtils function within the DES Key Handler component of elunez eladmin. Manipulation of the STR PARAM argument with the input Passw0rd results in inadequate encryption strength. This issue can be exploited remotely and is considered to have high complexity, making exploitation difficult. The vulnerable function is located in the file eladmin-common/src/main/java/me/zhengjie/utils/EncryptUtils.java.

Recommendations: Update elunez eladmin to version 2.8 or later.

Fix

Inadequate Encryption Strength

Weakness Enumeration

CWE-310

CWE-326

Related Identifiers

CVE-2025-9239

Affected Products

Elunez Eladmin

References · 9

• https://github.com/elunez/eladmin/issues/884 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-9239 · Security Note
• https://osv.dev/vulnerability/CVE-2025-9239 · Vendor Advisory
• https://vuldb.com/?submit.631393 · Note
• https://vuldb.com/?ctiid.320772 · Note
• https://t.me/CVEtracker/30515 · Telegram Post
• https://twitter.com/CVEnew/status/1958397801219445072 · Twitter Post
• https://vuldb.com/?id.320772 · Note
• https://twitter.com/VulmonFeeds/status/1958330262753882301 · Twitter Post