VulnerabilityAwaiting Analysis

CVE-2025-8095

It has been identified as cryptographically weak and unsuitable for stored encodings and enterprise applications.

CRITICAL 9.1EPSS 0.22%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.22%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

The OECH1 prefix encoding is intended to obfuscate values across the OpenEdge platform. It has been identified as cryptographically weak and unsuitable for stored encodings and enterprise applications. OECH1 encodings should be considered exploitable and immediately replaced by any other supported prefix encoding, all of which are based on symmetric encryption.

CVSS 4.0: 9.1 CRITICALCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
EPSS: 0.22% probability · 12th percentile
CISA KEV: Not listed
Weakness: CWE-257
Source: security@progress.com

References

https://community.progress.com/s/article/Unintended-Use-of-OECH1-for-Password-Secrets-Protection

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.