This is a plaintext password storage vulnerability in Streamsoft BI, and it should not exist in any modern commercial application. Password hashing is not advanced security knowledge — it's introductory material supported by standard libraries in every major language ecosystem. The fact that a commercial Business Intelligence platform shipped with this flaw indicates a systemic process failure: no code review caught it, no static analysis flagged it, and no pipeline check enforced secure storage patterns.
The CVSS 7.1 score materially understates the real risk. The genuine danger is not the local credential exposure — it's the cascade through credential reuse. Enterprise BI platforms are administered by users who frequently reuse credentials across multiple systems because managing unique passwords is inconvenient. Every Streamsoft user who reset their password may have already exposed a master key to their broader identity infrastructure if they reused that credential elsewhere.
The EPSS score of 0.0016 does not indicate the codebase is clean — it indicates this vulnerability class lacks noisy exploitation signatures. Plaintext credential storage gets discovered during incident response, penetration tests, mergers, or audits, not mass scanning. The low EPSS likely means whoever found this had privileged access (database, backup, or internal), which actually reinforces the systemic failure hypothesis.
The remediation — version 6.8.0.0 plus mandatory password reset — is reactive damage control. It addresses the symptom, not the pathology. Examine what process changes accompanied this patch. If it was purely a code change with no review workflow updates, assume other authentication shortcuts survive in the same module. The password reset closes the current exposure but tells you nothing about how long plaintext values persisted in production or whether backups already copied those credentials elsewhere.
Priorities: review all authentication-related code in the same module for other insecure patterns, treat the auth architecture as suspect until proven otherwise, and explicitly warn users about the credential reuse risk rather than just instructing them to reset their Streamsoft password.