Listen to this Post
Intro – How CVE-2025-15624 Works
CVE-2025-15624 is a critical vulnerability affecting the Pro Cloud Server component of Sparx Systems’ Enterprise Architect ecosystem. The issue lies in the server’s handling of user credentials when OpenID is used as the primary authentication method. Instead of relying solely on the external OpenID provider, the Pro Cloud Server creates a local password for each user and stores it in plaintext on the server’s local storage or database. This occurs regardless of whether OpenID is the only intended authentication mechanism.
The vulnerability is present in version 6.0.163 and likely affects all earlier versions up to that build. It is categorized under CWE-256 (Plaintext Storage of a Password), which is a fundamental design flaw that violates basic security principles for credential handling. The CVSS base score is 9.3 (Critical), indicating a high severity with a low attack complexity and no required privileges.
From an attacker’s perspective, the exploitation vector is straightforward. If an attacker gains read access to the server’s local storage (e.g., via a compromised backup, a misconfigured database, or an unrelated file-inclusion vulnerability), they can directly extract the plaintext passwords. No authentication is needed to read the stored passwords once the storage is compromised. The attacker can then use these credentials to impersonate the affected users, gaining unauthorized access to the Sparx EA system and potentially other integrated services that rely on the same credentials.
The vulnerability was discovered by Pasi Orovuo, Henri Hämäläinen, and Samu Ahvenainen from Solita Oy, and it was publicly disclosed on April 17, 2026. As of the disclosure date, a patch is available, and organizations are strongly advised to apply it immediately. There is no evidence of public proof-of-concept (PoC) or active exploitation at the time of this writing, but the risk of credential exposure remains high for unpatched instances.
DailyCVE Form
Platform: Sparx Pro Cloud
Version: 6.0.163
Vulnerability: Plaintext password storage
Severity: Critical
Date: 2026-04-17
Prediction: Patch available 2026-04-17
What Undercode Say
Check for plaintext passwords in local storage
find /opt/sparx/ -name ".conf" -exec grep -Hn "password=" {} \;
Check the Pro Cloud Server database for plaintext passwords
sqlite3 /var/lib/sparx/pcs.db "SELECT username, password FROM users;"
Verify if OpenID is used and local passwords are still stored
curl -k https://pcs-server.local/SparxCloudLink.sseap --data "request=GetUserList"
Exploit:
An attacker with read access to the server’s local storage or database can directly extract user passwords in plaintext. These passwords can then be used to authenticate to the Sparx EA system and any other service where the same credentials are reused, leading to account takeover and lateral movement within the organization.
Protection:
- Immediately apply the vendor patch (available as of April 17, 2026) that removes the creation of local passwords or encrypts them properly.
- Disable local password storage when OpenID is the primary authentication method, ensuring only OpenID credentials are used.
- Restrict server file system permissions so that only privileged administrator accounts can read password files.
- Implement logging and monitoring to detect unauthorized access attempts and credential harvesting.
Impact:
- Confidentiality breach: Any user credential stored in plaintext can be read by an attacker.
- Unauthorized access: Obtained credentials allow full access to Sparx EA systems and potentially other integrated services.
- Lateral movement: Attackers can use compromised credentials to move laterally within the organization.
- Data breach: Exposure of credentials can lead to further compromise of sensitive data and models.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
