SH3 EUVD-2026-109546

Exploitation requires the attacker to already have high-privilege access (CVSS PR:H) sufficient to read SH3's stored user credential data within the Módulo de Gestão/Módulo de Arrecadação components; the core weakness is that credentials are stored with a reversible XOR-based encoding (CWE-916) rather than a computationally expensive one-way hash, so recovered values can be reversed to plaintext. Exploitation is limited by the need for that privileged access and by high attack complexity (AC:H) - the vendor explicitly reports exploitability as difficult. Impact is confined to confidentiality of stored credentials (VC:L); there is no integrity or availability effect. The only complete remediation stated in the sources is upgrading to version 2026.0.2.0.

All decision signals converge on LOW real-world priority. The vendor CVSS 4.0 base score is 2.1 (Low); although the vector is AV:N (network), it is heavily constrained by AC:H (high attack complexity), PR:H (high privileges required), and only VC:L impact (low confidentiality, with no integrity or availability effect). The exploit maturity metric is E:P (proof-of-concept), and the vuln.today decision label is 'monitor' - the lowest actionable tier. No EPSS score was provided, so exploitation probability cannot be quantified from the input. This CVE is NOT in CISA KEV, so there is no confirmed active exploitation. A public PoC reference exists (a Medium write-up) but it is not verified as working exploit code, so PoC availability must not be conflated with real-world exploitation. In short, this is a genuine cryptographic hygiene weakness (reversible credential storage) rather than an urgent threat: high complexity, high required privileges, and low impact together make it a low-priority, defense-in-depth fix rather than an emergency.

An attacker who already holds high-privilege access to an SH3 deployment (per CVSS PR:H) retrieves the stored user credential values and reverses the weak XOR-based encoding to recover plaintext passwords, which could then be reused against other accounts or systems. A public PoC reference (Medium write-up) describes the reversible XOR mechanism, but it is not verified as working exploit code, and CVSS AC:H indicates the attack is difficult to carry out in practice.