The STER software used a weak password encoding algorithm, classified under CWE-261 (Weak Encoding for Password). This flaw enables attackers to deduce passwords by studying the encoding patterns of known passwords. The vulnerability affects versions prior to 9.5, and the vendor addressed the issue by fixing it in version 9.5. The CVSS 4.0 vector indicates the attack requires local access with high attack complexity and low privileges, and no user interaction is needed. There is no indication of known exploits in the wild. The vendor has not provided explicit remediation level details beyond the version fix.

An attacker with local access and low privileges could potentially guess user passwords due to the weak encoding algorithm, compromising password confidentiality. This could lead to unauthorized access if passwords are reused or if the attacker escalates privileges. However, the attack complexity is high, and no remote exploitation or user interaction is required. No known exploits are reported in the wild.

Upgrade the STER software to version 9.5 or later, where the weak password encoding vulnerability has been fixed. Since the vendor advisory confirms the issue is resolved in this version, applying this update is the recommended remediation. Patch status beyond this version is not explicitly stated, so verify with the vendor for any additional updates or guidance.