CVE-2025-13175: Y Soft SafeQ 6 Information Disclosure

CVE-2025-13175 Overview

Y Soft SafeQ 6 contains an information disclosure vulnerability in the Workflow Connector password field rendering mechanism. The application renders the password field in a way that allows an administrator with UI access to reveal the stored password value using browser developer/inspection tools. This affects customers who have configured a password-protected scan workflow connector.

Critical Impact

Administrators with access to the SafeQ 6 management interface can expose Workflow Connector credentials through browser inspection tools, potentially compromising integrated systems and workflow automation configurations.

Affected Products

• Y Soft SafeQ 6 versions prior to MU106
• Y Soft SafeQ 6 installations with password-protected scan workflow connectors

Discovery Timeline

• 2026-01-14 - CVE CVE-2025-13175 published to NVD
• 2026-01-14 - Last updated in NVD database

Technical Details for CVE-2025-13175

Vulnerability Analysis

This vulnerability falls under CWE-549 (Missing Password Field Masking), a common information disclosure weakness where sensitive credential fields are not properly protected from client-side inspection. The issue stems from improper handling of password field rendering in the SafeQ 6 administrative interface.

When administrators access the Workflow Connector configuration page, the password field contains the actual credential value in a manner that can be inspected through standard browser developer tools. While the field may visually appear masked (displaying dots or asterisks), the underlying HTML or JavaScript stores the password value in an accessible format.

This represents a failure to implement proper password field security practices. Modern secure web applications should never transmit stored passwords back to the client side, instead using placeholder values or tokens when displaying previously-configured credentials.

Root Cause

The root cause is improper implementation of password field masking in the SafeQ 6 web interface. The application transmits the actual password value to the browser when rendering the Workflow Connector configuration form, rather than using a secure placeholder or omitting the value entirely. This allows anyone with access to browser developer tools to inspect the DOM or network traffic and retrieve the stored credential.

Attack Vector

The attack requires network access to the SafeQ 6 administrative interface and high privileges (administrative credentials). An attacker with legitimate admin access, or one who has compromised an admin account, can navigate to the Workflow Connector settings, open browser developer tools (F12), and inspect the password input element to reveal the stored credential value.

This credential exposure could enable lateral movement if the Workflow Connector password is reused across other systems, or allow an attacker to maintain persistent access to integrated workflow systems even after their administrative access is revoked.

Detection Methods for CVE-2025-13175

Indicators of Compromise

• Unusual access patterns to Workflow Connector configuration pages in SafeQ 6 administrative logs
• Multiple administrative sessions accessing connector settings without making configuration changes
• Evidence of browser developer tool usage in conjunction with administrative interface access

Detection Strategies

• Monitor SafeQ 6 administrative audit logs for repeated access to Workflow Connector configuration sections
• Implement session monitoring to detect unusual administrative activity patterns
• Review access logs for administrative interface usage from unexpected IP addresses or at unusual times

Monitoring Recommendations

• Enable detailed logging for all administrative interface access in SafeQ 6
• Configure alerts for access to sensitive configuration pages including Workflow Connector settings
• Implement user behavior analytics to detect anomalous administrative actions

How to Mitigate CVE-2025-13175

Immediate Actions Required

• Update Y Soft SafeQ 6 to version MU106 or later immediately
• Rotate all Workflow Connector passwords after applying the update
• Review administrative access logs for any suspicious configuration page access
• Audit and restrict administrative access to the SafeQ 6 interface to essential personnel only

Patch Information

Y Soft has released MU106 (Maintenance Update 106) to address this vulnerability. Administrators should update to this version or later to remediate the password exposure issue. Detailed release information is available in the YSoft SafeQ6 Release Notes. Additional vulnerability analysis is available from CERT Poland.

Workarounds

• Restrict administrative access to the SafeQ 6 interface to only trusted personnel until the patch can be applied
• Implement network segmentation to limit access to the administrative interface from trusted networks only
• Consider implementing additional authentication mechanisms such as MFA for administrative access
• Avoid using shared or reused passwords for Workflow Connector configurations

# Configuration example
# Restrict administrative interface access by IP using firewall rules
# Example iptables rule to limit access to SafeQ admin port
iptables -A INPUT -p tcp --dport 443 -s 10.0.1.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP