# CVE-2026-25608: CIOP-PIB STER cleartext transmission of sensitive information

Source: https://junglewise.ai/threats/cve-2026-25608-ciop-pib-ster-cleartext-transmission-of-sensitive-information  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-22. Updated: 2026-05-22  
License: CC BY 4.0 with a link back

CVE-2026-25608 · Severity: info · CVSS 2.3 · Published 2026-05-22

STER, a software suite used for occupational health and safety management, transmits data over the network using unencrypted TCP traffic. This allows an attacker positioned on the same network to intercept sensitive information, including user passwords, personal data, and authentication tokens. Such an exploit could lead to unauthorized account access and the exposure of confidential employee or organizational records.

## Quick answers

**Is CVE-2026-25608 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-25608 being exploited in the wild.

**How severe is CVE-2026-25608?** Informational severity, with a CVSS score of 2.3, published 22 May 2026.

**Which products and versions are affected?** Centralny Instytut Ochrony Pracy - Państwowy Instytut Badawczy (CIOP-PIB) STER All versions prior to 9.5.

**Is there a fix for CVE-2026-25608?** A patch was published on 2026-05-22: Fix released in version 9.5 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-25608 attacked?** It is attacked over the network or from the adjacent network, in a network appliance.

**Am I affected by CVE-2026-25608?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The STER application suffers from cleartext transmission of sensitive information (CWE-319) due to the use of unencrypted TCP traffic for network communications. An attacker with the ability to intercept network traffic (e.g., via a Man-in-the-Middle position) can capture sensitive data such as passwords and authentication tokens in plain text. This vulnerability affects all versions of the software prior to 9.5. The issue is resolved in version 9.5, which likely introduces encryption for data in transit.

## Affected products

- Centralny Instytut Ochrony Pracy - Państwowy Instytut Badawczy (CIOP-PIB) STER All versions prior to 9.5

## Timeline

- 2026-05-22: advisory: Advisory published by CERT.PL and NVD
- 2026-05-22: patched: Fix released in version 9.5

## References

- [https://cert.pl/posts/2026/05/CVE-2026-25606](https://cert.pl/posts/2026/05/CVE-2026-25606)
- [https://www.ciop.pl/CIOPPortalWAR/appmanager/ciop/pl?_nfpb=true&_pageLabel=P52000165211572544981480](https://www.ciop.pl/CIOPPortalWAR/appmanager/ciop/pl?_nfpb=true&_pageLabel=P52000165211572544981480)