CVE-2023-51839 is a use of a broken or risky cryptographic algorithm in DeviceFarmer stf 3.6.6, the Smartphone Test Farm. The project's issue says it uses DES in ECB mode. The record rates it Critical at 9.1. No fixed version is named, so check the project.
What's affected
DeviceFarmer stf 3.6.6. The record names the product as Smartphone Test Farm. It does not list a fixed version.
The project's issue 736 is titled Use of Outdated and Insecure Algorithm DES-ECB to encrypt, which tells us which algorithm is the concern. Read the issue for the current state of any fix.
The record gives a CVSS score of 9.1 (Critical). The CVSS vector reads as follows. The attack can be reached over the network, and the complexity is low. No account is needed. No user interaction is required. Impact on confidentiality is high, on integrity high, and on availability none. The weakness class is CWE-327.
How to check if you're exposed
Check your installed version with npm ls -a | grep -i stf in your deployment directory, or the package manifest of your container image. A version of 3.6.6 is the one named.
Then find where your deployment uses stf's encrypted values, such as tokens or secrets passed between components.
What to do now
- Find stf deployments and their versions.
- Read issue 736 and the project's releases for a fix, and upgrade if one exists.
- Do not expose stf to untrusted networks, and put it behind your own authentication.
- Rotate any secrets that stf encrypts, if you believe they may have been captured.
- Plan a migration if the project does not address the issue.
Why it matters
DES is an old cipher with a small key, and ECB mode encrypts identical blocks to identical outputs, which leaks patterns. Each choice is weak alone and the combination is worse. The weakness class is CWE-327.
The 9.1 score reflects high impact on confidentiality and integrity with no privileges needed. If values protected this way control access, an attacker who can capture and break or forge them may gain access.
Test farms hold real devices and often real accounts. Keep them on internal networks.
If you run a device farm, also review who can reach it. Test farms often start as an internal convenience and gradually gain wider access, so confirm the network boundary around yours and make sure it still matches what you intended when you set it up.
Quick check
Which algorithm is the problem?
The project's issue title names DES in ECB mode.
Is there a patch?
The record names none. Check issue 736 and the project releases.
Sources
Last reviewed: 19 October 2026.
