CVE-2025-59745
BaseFortify
Publication date: 2025-10-02
Last updated on: 2025-10-02
Assigner: Spanish National Cybersecurity Institute, S.A. (INCIBE)
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| andsoft | e-tms | 25.03 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-327 | The product uses a broken or risky cryptographic algorithm or protocol. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is due to the use of the MD5 cryptographic hash algorithm in AndSoft's e-TMS v25.03 for encrypting passwords. MD5 is considered cryptographically weak and vulnerable to collision attacks, meaning attackers can create different inputs that produce the same hash output. Because of this weakness, passwords encrypted with MD5 can be easily cracked using modern hardware, exposing user credentials to potential compromise.
How can this vulnerability impact me? :
The vulnerability can lead to exposure of user credentials because the MD5 hash used to encrypt passwords can be cracked easily. This can allow attackers to gain unauthorized access to user accounts or systems protected by these passwords, potentially leading to data breaches or unauthorized actions.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, you should stop using MD5 for password encryption in AndSoft's e-TMS v25.03 and replace it with a more secure cryptographic hash algorithm such as SHA-256 or bcrypt. Additionally, update or patch the software if a vendor fix is available, and enforce strong password policies to reduce risk.