CVE-2025-15624
CWE-256Published: April 17, 2026· Updated: Jun 17, 2026
Official Description
Plaintext Storage of a Password vulnerability in Sparx Systems Pty Ltd. Sparx Pro Cloud Server.
In a setup where OpenID is used as the primary method of authentication to authenticate to Sparx EA, Pro Cloud Server creates local passwords to the users and stores them in plaintext.
Risk Analysis
This critical vulnerability in Sparx Pro Cloud Server involves the plaintext storage of user passwords when OpenID is used for authentication. With a CVSS score of 9.3, this flaw enables attackers to easily compromise user accounts and potentially gain unauthorized access to other systems. The absence of an EPSS score means its exploitation likelihood is not yet predicted, but the critical severity warrants immediate action.
No public exploit is currently known for this vulnerability. The remote attack vector (AV:N) indicates it can be exploited over a network.
Organizations using Sparx Pro Cloud Server should apply vendor patches to address this plaintext password storage issue. Ensure that all authentication mechanisms securely hash and salt passwords, and avoid storing sensitive credentials in plaintext.
Technical Analysis
CVE-2025-15624 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.
The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.
A successful exploit results in complete confidentiality breach (data exposure), with a CVSS base score of 7.5.
CVSS v3.1 Vector Breakdown
Affected Vendors & Products
Exploit & PoC Resources
All References (1)
Quick Facts
Related CVEs (CWE-256)
Recommended Actions
- →Apply vendor patches immediately
- →Monitor CVE-2025-15624 in threat intel feeds
- →Review IDS/IPS signatures for exploitation attempts