CVE-2025-58743
Published: 20 January 2026
Summary
CVE-2025-58743 is a high-severity Use of a Broken or Risky Cryptographic Algorithm (CWE-327) vulnerability in Milner Imagedirector Capture. Its CVSS base score is 7.2 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Password Cracking (T1110.002); ranked at the 1.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-13 (Cryptographic Protection) and IA-5 (Authenticator Management).
Deeper analysis
CVE-2025-58743 is a Use of a Broken or Risky Cryptographic Algorithm vulnerability involving DES in the Password class within C2SConnections.dll of Milner ImageDirector Capture on Windows. This flaw enables encryption brute forcing to obtain database credentials and affects ImageDirector Capture versions from 7.0.9.0 before 7.6.3.25808. The issue is classified under CWE-327 with a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), indicating high confidentiality impact.
A remote attacker with network access can exploit this vulnerability without authentication, privileges, or user interaction due to low attack complexity. Successful exploitation allows brute forcing the weak DES encryption to recover database credentials, potentially enabling unauthorized access to sensitive data stored in the database.
Mitigation details are available in advisories at https://sra.io/advisories. Vulnerable installations should be upgraded to ImageDirector Capture version 7.6.3.25808 or later to address the issue.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-206308
Vulnerability details
Use of a Broken or Risky Cryptographic Algorithm (DES) vulnerability in the Password class in C2SConnections.dll in Milner ImageDirector Capture on Windows allows Encryption Brute Forcing to obtain database credentials.This issue affects ImageDirector Capture: from 7.0.9.0 before 7.6.3.25808.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Directly enables brute-force cracking of weak DES-encrypted credentials to recover database passwords.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires use of approved cryptographic algorithms and prohibits weak ones such as DES for protecting credentials.
Mandates cryptographic protection of information at rest, which would prevent storage of database credentials under a breakable DES scheme.
Requires secure management and storage of authenticators, precluding use of weak encryption that enables brute-force recovery of credentials.