CVE-2025-5922
BaseFortify
Publication date: 2025-07-29
Last updated on: 2025-07-31
Assigner: CERT.PL
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| tsplus | remote_access | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-759 | The product uses a one-way cryptographic hash against an input that should not be reversible, such as a password, but the product does not also use a salt as part of the input. |
| CWE-522 | The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-5922 is a vulnerability in TSplus Remote Access Admin Tool where the PIN code's hash is stored unsafely in the system registry without salting, making it accessible to regular users. This allows attackers to perform brute-force attacks using rainbow tables to recover the PIN, potentially bypassing access restrictions. [1]
How can this vulnerability impact me? :
If exploited, this vulnerability can allow an attacker with regular user access to recover the administrator PIN by brute-force attacks, potentially gaining unauthorized administrative access to the TSplus Remote Access Admin Tool, which could lead to further system compromise. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
You can detect this vulnerability by checking the version of TSplus Remote Access Admin Tool installed on your system. Versions prior to v18.40.6.17, v17.2025.6.27, and v16.2025.6.27 are vulnerable. Additionally, you can inspect the system registry for the presence of the PIN hash stored without salting and accessible to regular users. Specific commands are not provided in the resources, but checking the installed software version and registry entries related to TSplus Remote Access Admin Tool is recommended. [1]
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation step is to update the TSplus Remote Access Admin Tool to version v18.40.6.17 or later, or to the patched LTS versions v17.2025.6.27 or v16.2025.6.27. These updates secure the storage of the PIN hash and prevent brute-force attacks. Additionally, ensure that the "Disable UAC" option is not enabled to maintain access restrictions to administrators. [1]