Kantech Entrapass EUVD-2026-109979

Exploitation requires local access to the system running Kantech Entrapass (AV:L), high-level privileges on that host (PR:H), and active user interaction (UI:A), plus a present attack requirement (AT:P) whose specific trigger is not described in the available sources. The sensitive data is exposed because Entrapass stores it in cleartext in memory (CWE-316), so an actor meeting those preconditions can read embedded sensitive data from the application's memory. Limiting factors: this is not remotely or network-exploitable and not exploitable by an unauthenticated or low-privileged user - it depends on an already-privileged local actor and user interaction, confining realistic risk to insiders or post-compromise situations on versions before 9.20. The only complete fix stated by the vendor is upgrading to Entrapass 9.20 or later.

This is a moderate, low-urgency issue rather than a top-tier priority. The vendor-supplied CVSS 4.0 vector (AV:L/AC:L/AT:P/PR:H/UI:A) describes a locally-exploitable flaw that requires high privileges (PR:H), active user interaction (UI:A), and a present attack requirement (AT:P) - a demanding precondition set that sharply limits real-world exploitability. There is no CISA KEV listing and no EPSS score in the supplied data, so there is no signal of active or probable widespread exploitation; status is no public exploit identified at time of analysis. The vuln.today decision label is 'this_month,' which is consistent with a patch-on-normal-cadence posture rather than an emergency. The base score of 5.3 is driven by the high confidentiality/integrity impact ratings (VC:H/VI:H) in the vector, but these are gated behind local high-privilege access and user interaction, so the effective real-world risk is lower than the impact metrics alone suggest. Note a conflict worth flagging: the weakness is CWE-316 (cleartext storage of sensitive information) and the description frames the outcome purely as 'Retrieve Embedded Sensitive Data' (a confidentiality/disclosure outcome), yet the vendor vector asserts VI:H (high integrity impact) - the mechanism for an integrity impact is not described in the available sources and should be verified with the vendor advisory.

An attacker who already has high-privilege local access to a host running Kantech Entrapass (for example a malicious or compromised operator account) inspects the application's process memory and recovers sensitive data that is stored there in cleartext. Because the vector requires local access (AV:L), high privileges (PR:H), and active user interaction (UI:A), this is a post-compromise or insider-style scenario rather than remote exploitation. No public exploit or PoC is identified in the supplied data.