Click Studios Passwordstate risky encryption

published 2022-12-19 3 y ago modified 2026-06-17 4 mo ago also EUVD-2022-51941

cvss: 1.9; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.2%; EPSS 0.2% chance of exploitation in 30 days, percentile 15%
public exploits: 0; none known

A vulnerability, which was classified as problematic, has been found in Click Studios Passwordstate and Passwordstate Browser Extension Chrome. Affected by this issue is some unknown functionality. The manipulation leads to risky cryptographic algorithm. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-216272.

Patch / fix

fixed in 1

clickstudios passwordstate 9.5

CISA SSVC

Exploitation: Proof of concept is public
Automatable: no
Technical impact: partial
Assessed: 18 mo ago (2025-04-14)

Exploit prediction

0.24% chance of exploitation in the next 30 days, higher than 15% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

modzero.com https://modzero.com/modlog/archives/2022/12/19/better_make_sure_your_password_manager_is_secure/index.html referenced PoC, tagged "exploit" by a source, unverified
modzero.com https://www.modzero.com/static/MZ-22-03_Passwordstate_Security_Disclosure_Report-v1.0.pdf referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
CNA	3.1	1.9	CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N
NVD	3.1	5.5	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Affected products

Click Studios Passwordstate
Click Studios Passwordstate Browser Extension Chrome

Classification

Weakness

CWE-310 Cryptographic Issues
CWE-327 Use of a Broken or Risky Cryptographic Algorithm

References

modzero.com /modlog/archives/2022/12/19/better_make_sure_your_password_manager_is_secure/index.html
exploit, third-party-advisory
modzero.com /static/MZ-22-03_Passwordstate_Security_Disclosure_Report-v1.0.pdf
exploit, third-party-advisory
vuldb.com /?id.216272
third-party-advisory

Sources

CVE List CVE-2022-4610
NVD CVE-2022-4610

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary