Openedge EUVD-2025-209440

CVSS 4.0 score of 9.1 reflects critical severity with network attack vector (AV:N), low complexity (AC:L), no privileges required (PR:N), and high impact across confidentiality, integrity, and availability for both vulnerable and subsequent systems (VC:H/VI:H/VA:H/SC:H/SI:H/SA:H). SSVC framework confirms automatable exploitation with total technical impact, but exploitation status is 'none' at analysis time. EPSS data not provided, but the automatable nature and credential-focused impact suggest high weaponization potential once tooling emerges. The network attack vector combined with PR:N means any attacker accessing OECH1-encoded configuration files (via web server misconfiguration, backup exposure, supply chain compromise, or insider access) can reverse credentials without authentication barriers. However, absence of confirmed active exploitation (not KEV-listed) and unclear EPSS probability moderates immediate urgency compared to exploited RCE flaws. Risk escalates sharply in environments where OECH1-encoded database credentials or admin passwords are network-accessible in config repositories, CI/CD pipelines, or cloud storage. Organizations must treat this as a credential hygiene emergency requiring immediate inventory and re-encoding, not just a patch cycle item.

An attacker discovers an OpenEdge application's configuration backup exposed via misconfigured cloud storage bucket or compromised CI/CD pipeline. The backup contains database.properties with OECH1-encoded admin password. Using publicly documented OECH1 decoding algorithms (or reverse-engineered tools likely to emerge), the attacker recovers plaintext credentials in seconds without cryptographic expertise. With database admin access, the attacker exfiltrates customer PII, injects backdoor stored procedures, or pivots to connected enterprise systems using the compromised credentials. The automatable nature enables mass scanning of exposed config files across internet-facing OpenEdge deployments.