How severe is CVE-2025-8307?

CVE-2025-8307 has a CVSS 4.0 base score of 5.9, rated medium severity.

Is CVE-2025-8307 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (1st percentile), an estimate of the probability of exploitation in the next 30 days.

How do I fix CVE-2025-8307?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

Does CVE-2025-8307 have an EU (EUVD) identifier?

Yes. CVE-2025-8307 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-1565.

When was CVE-2025-8307 published?

CVE-2025-8307 was published on 2026-01-08 and last updated on 2026-06-17.

CVE-2025-8307

CVE-2025-8307 is a medium-severity vulnerability with a CVSS 4.0 base score of 5.9. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-257.

Key facts

Severity: Medium (CVSS 4.0 base score 5.9)
EPSS exploit prediction: 0% (1st percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2026-1565
Weakness: CWE-257
Published: 2026-01-08
Last modified: 2026-06-17

Description

Asseco InfoMedica is a comprehensive solution used to manage both administrative and medical tasks in the healthcare sector. Passwords of all users are stored in a database in an encoded format. An attacker in possession of these encoded passwords is able to decode them by using an algorithm embedded in the client-side part of the software. This vulnerability has been fixed in versions 4.50.1 and 5.38.0

Frequently asked questions

What is CVE-2025-8307?: Asseco InfoMedica is a comprehensive solution used to manage both administrative and medical tasks in the healthcare sector. Passwords of all users are stored in a database in an encoded format. An attacker in possession of these encoded passwords is able to decode them by using an algorithm embedded in the client-side part of the software. This vulnerability has been fixed in versions 4.50.1 and 5.38.0
How severe is CVE-2025-8307?: CVE-2025-8307 has a CVSS 4.0 base score of 5.9, rated medium severity.
Is CVE-2025-8307 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (1st percentile), an estimate of the probability of exploitation in the next 30 days.
How do I fix CVE-2025-8307?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
Does CVE-2025-8307 have an EU (EUVD) identifier?: Yes. CVE-2025-8307 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-1565.
When was CVE-2025-8307 published?: CVE-2025-8307 was published on 2026-01-08 and last updated on 2026-06-17.

References

https://cert.pl/en/posts/2026/01/CVE-2025-8306/

Other CWE-257 vulnerabilities

CVE-2025-8095 — Critical (CVSS 9.1): The OECH1 prefix encoding is intended to obfuscate values across the OpenEdge platform. It has been identified as…
CVE-2025-8904 — High (CVSS 8.5): Amazon EMR Secret Agent creates a keytab file containing Kerberos credentials. This file is stored in the /tmp/…
CVE-2025-34180 — High (CVSS 8.4): NetSupport Manager < 14.12.0001 relies on a shared Gateway Key for authentication between Manager/Control, Client,…
CVE-2025-6996 — High (CVSS 8.4): Improper use of encryption in the agent of Ivanti Endpoint Manager before version 2024 SU3 and 2022 SU8 Security Update…
CVE-2025-6995 — High (CVSS 8.4): Improper use of encryption in the agent of Ivanti Endpoint Manager before version 2024 SU3 and 2022 SU8 Security Update…
CVE-2016-15058 — High (CVSS 8.1): Hirschmann HiLCOS Classic Platform switches Classic L2E, L2P, L3E, L3P versions prior to 09.0.06 and Classic L2B prior…

Browse all CWE-257 vulnerabilities →