What’s Vulnerable › Vulnerabilities

CVE-2025-51540

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-08-19 · updated 2026-06-17
• Weakness: CWE-260

Description

EzGED3 3.5.0 stores user passwords using an insecure hashing scheme: md5(md5(password)). This hashing method is cryptographically weak and allows attackers to perform efficient offline brute-force attacks if password hashes are disclosed. The lack of salting and use of a fast, outdated algorithm makes it feasible to recover plaintext credentials using precomputed tables or GPU-based cracking tools. The vendor states that the issue is fixed in 3.5.72.27183.

References

• https://ballpoint.fr/en/blog/ezged3-preauth-file-read-admin-takeover

Get alerted when CVE-2025-51540 or the next vulnerability affects your stack