SQL & PL/SQL

have the following strings, which vary in length(see below). How can I mask the data with '*' with the exception of the first and last characters.

Can this be done with regexp_replace? Thanks to all who answer.

CREATE TABLE CARDS_TBL (
  CARD_ID NUMBER
    GENERATED BY DEFAULT AS IDENTITY,
  CARD_STR VARCHAR2(16) NOT NULL,
  PRIMARY KEY (CARD_ID)
);


INSERT INTO CARDS_TBL(CARD_STR) VALUES('4024007187788590');
INSERT INTO CARDS_TBL(CARD_STR) VALUES('5432223398564536');
INSERT INTO CARDS_TBL(CARD_STR) VALUES('5430434');
INSERT INTO CARDS_TBL(CARD_STR) VALUES('406755227854');
INSERT INTO CARDS_TBL(CARD_STR) VALUES('54312318');


Desired output:

CARDS_STR MASKED_STR
4024007187788590 4**************0
5432223398564536 5**************6
5430434                   5*****4
406755227854        4**********4
54312318                5******8