CVE-2025-58740CWE-321

Hardcoded Encryption Key Enables Database Credential Access in Milner ImageDirector Capture

High · published January 20, 2026

CVSS v4.0
8.5
EPSS
0%
Percentile
0.1
In the wild
Unconfirmed
What it is

The use of a hard-coded encryption key in calls to the Password function in C2SGlobalSettings.dll in Milner ImageDirector Capture on Windows allows a local attacker to decrypt database credentials by reading the cryptographic key from the executable.

This issue affects ImageDirector Capture: from 7.0.9 before 7.6.3.25808.

The record
Technical detail
CVSS v4.0
8.5 · HIGH
Vector
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:H/SC:H/SI:H/SA:H
EPSS
0.00072 · 0.1th percentile
Weakness
CWE-321 · Use of Hard-coded Cryptographic Key
Published
2026-01-20T21:36Z
EPSS history
Timeline
  • 20 JAN 21:36Z
    Hardcoded Encryption Key Enables Database Credential Access in Milner ImageDirector Capture
    cvelistv5