CVE-2026-41879
Weak password hashing in R-SOFT DMS
- State
- Published
- Severity
- 8.2 High
- Published
- Jul 10, 2026
- Updated
- Jul 10, 2026
- Reserved
- Apr 22, 2026
Description
R-SOFT DMS stores superadmin credentials using a non-salted nested MD5 hash. This allows an attacker who obtain password hash to decode superadmin credentials. Critically, this password cannot be changed except by modifying the configuration file.
This issue was fixed in version v3.17-2000.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 8.2 High | CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N | CERT-PL |
Weaknesses
- CWE-328 Use of Weak Hash
Affected Products
| Product | Versions |
|---|---|
DMSR-SOFT SERWIS |
|
References
- https://cert.pl/posts/2026/07/CVE-2026-41876third-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.