CVE-2025-51540

EzGED3 3.5.0 stores user passwords using an insecure hashing scheme: md5(md5(password)). This hashing method is cryptographically weak and allows attackers to perform efficient offline brute-force attacks if password hashes are disclosed. The lack of salting and use of a fast, outdated algorithm makes it feasible to recover plaintext credentials using precomputed tables or GPU-based cracking tools. The vendor states that the issue is fixed in 3.5.72.27183.

EzGED3 3.5.0 stores user passwords using an insecure hashing scheme: md5(md5(password)). This hashing method is cryptographically weak and allows attackers to perform efficient offline brute-force attacks if password hashes are disclosed. The lack of salting and use of a fast, outdated algorithm makes it feasible to recover plaintext credentials using precomputed tables or GPU-based cracking tools. The vendor states that the issue is fixed in 3.5.72.27183.

EzGED3 3.5.0 almacena las contraseñas de los usuarios mediante un esquema de hash inseguro: md5(md5(contraseña)). Este método de hash es criptográficamente débil y permite a los atacantes realizar ataques de fuerza bruta sin conexión si se divulgan los hashes de las contraseñas. La ausencia de sal y el uso de un algoritmo rápido y obsoleto permiten recuperar credenciales de texto plano mediante tablas precalculadas o herramientas de descifrado basadas en GPU. El proveedor afirma que el problema está corregido en la versión 3.5.72.27183.