CVE-2025-34208
BaseFortify
Publication date: 2025-10-02
Last updated on: 2025-10-09
Assigner: VulnCheck
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| vasion | virtual_appliance_application | * |
| vasion | virtual_appliance_host | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-327 | The product uses a broken or risky cryptographic algorithm or protocol. |
| CWE-759 | The product uses a one-way cryptographic hash against an input that should not be reversible, such as a password, but the product does not also use a salt as part of the input. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability involves Vasion Print Virtual Appliance Host and Application storing user passwords using unsalted SHA-512 hashes with a fallback to unsalted SHA-1. These hashing methods are fast and lack per-user salts, making them unsuitable for secure password storage. An attacker who obtains the password database can use offline dictionary or rainbow table attacks to recover cleartext passwords. Additionally, legacy SHA-1 hashes are migrated to SHA-512 on login, exposing users still on the old hash. The vulnerability remains partially present in the legacy authentication platform.
How can this vulnerability impact me? :
If an attacker obtains the password database, they can recover users' cleartext passwords through offline dictionary or rainbow table attacks due to weak hashing methods. This can lead to unauthorized access to user accounts and potentially further compromise of systems relying on these credentials.
What immediate steps should I take to mitigate this vulnerability?
Immediate steps include avoiding use of the legacy authentication platform that uses unsalted SHA-1 and SHA-512 hashes for password storage. Ensure that password storage uses strong, salted, and slow hashing algorithms instead of fast unsalted hashes. If possible, update or patch the Vasion Print Virtual Appliance Host and Application to versions that have resolved this vulnerability. Additionally, consider resetting user passwords to force re-hashing with secure methods and monitor for any unauthorized access.