CVE-2026-45787: electerm's encrypt method not safe enough
Impact Insecure sync encryption: deterministic AES-192-CBC with a fixed zero IV, constant KDF salt, and no MAC leads to confidentiality and integrity failures for synced bookmark/profile data. Attackers can crack common passwords across installs and perform undetected ciphertext bit-flips to alter config/bookmarks.
Patches
- https://github.com/electerm/electerm/commit/9dd8295e37d53396b980cd45dfc5ed11ad79b937
Workarounds
- No
References - Report / credit: https://github.com/Curly-Haired-Baboon - Electerm releases: https://github.com/electerm/electerm/releases
Other sources
electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to 3.9.5, deterministic AES-192-CBC with a fixed zero IV, constant KDF salt, and no MAC leads to confidentiality and integrity failures for synced bookmark/profile data. Attackers can crack common passwords across installs and perform undetected ciphertext bit-flips to alter config/bookmarks. This vulnerability is fixed in 3.9.5.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/electermto a version that resolves this vulnerability.Fixed in 3.9.5
Event History
Frequently Asked Questions
What is the severity of CVE-2026-45787?
CVE-2026-45787 is classified as a high-severity vulnerability due to serious confidentiality and integrity failures.
How do I fix CVE-2026-45787?
To fix CVE-2026-45787, upgrade the electerm package to version 3.9.5 or later.
What type of vulnerability is CVE-2026-45787?
CVE-2026-45787 is an insecure sync encryption vulnerability affecting bookmark and profile data.
What potential risks does CVE-2026-45787 pose?
CVE-2026-45787 allows attackers to crack common passwords and perform undetected bit-flips on ciphertext.
Which software is affected by CVE-2026-45787?
CVE-2026-45787 affects versions of the electerm package prior to 3.9.5.