CVE-2025-8095— Recoverable obfuscation using the OECH1 prefix encoding in OpenEdge
Quick assessment
Affected
Progress Software Corporation OpenEdge
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Progress OpenEdge是美国Progress公司的一个企业级应用开发与数据库管理平台。 Progress OpenEdge存在安全漏洞，该漏洞源于OECH1前缀编码加密强度弱，可能导致编码被利用。
Possible ATT&CK Techniques 1 AI
T1073
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2025-8095
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Recoverable obfuscation using the OECH1 prefix encoding in OpenEdge
Source: CVE Program / CVE List V5
Vulnerability Description
The OECH1 prefix encoding is intended to obfuscate values across the OpenEdge platform. It has been identified as cryptographically weak and unsuitable for stored encodings and enterprise applications. OECH1 encodings should be considered exploitable and immediately replaced by any other supported prefix encoding, all of which are based on symmetric encryption.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:U/AU:Y/V:D/RE:M/U:Red
Source: CVE Program / CVE List V5
Vulnerability Type
以可恢复格式存储口令
Source: CVE Program / CVE List V5
Vulnerability Title
Progress OpenEdge 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Progress OpenEdge是美国Progress公司的一个企业级应用开发与数据库管理平台。 Progress OpenEdge存在安全漏洞，该漏洞源于OECH1前缀编码加密强度弱，可能导致编码被利用。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Progress Software Corporation | OpenEdge | 12.2.0 ~ 12.2.18 | - |
|
II. Public POCs for CVE-2025-8095
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2025-8095
请登录查看更多情报信息。
Other References for CVE-2025-8095 (1)
IV. Related Vulnerabilities
Same product: OpenEdge
-
CVE-2025-7389
Unauthorized Arbitrary File Read via RMI in AdminServer Inte -
CVE-2025-7388
Authenticated Command Injection via configuration parameter -
CVE-2024-7346
Client connections using default TLS certificates from OpenE -
CVE-2024-7345
Direct local client connections to MS Agents can bypass auth -
CVE-2024-7654
Unauthenticated Content Injection in OpenEdge Management web
Same vendor: Progress Software Corporation
-
CVE-2026-65941
WhatsUp Gold versions prior to 26.0.2 contain an unauthentic -
CVE-2026-65940
WhatsUp Gold versions prior to 26.0.2 excessive file system -
CVE-2026-65939
WhatsUp Gold versions prior to 26.0.2 contain an arbitrary f -
CVE-2026-65938
WhatsUp Gold versions prior to 26.0.2 contain an improper au -
CVE-2026-65937
WhatsUp Gold versions prior to 26.0.2 contain multiple store
Same weakness: CWE-257
-
CVE-2026-69297
Windows DHCP Server Information Disclosure Vulnerability -
CVE-2026-80176
Dell Secure Connect Gateway 信任管理问题漏洞 -
CVE-2026-1836
Stored credentials in Redmine -
CVE-2026-22574
Fortinet FortiSOAR PaaS和Fortinet FortiSOAR on-premise 安全漏洞 -
CVE-2026-22576
Fortinet FortiSOAR PaaS和Fortinet FortiSOAR on-premise 安全漏洞
V. Comments for CVE-2025-8095
No comments yet