{"id":"CVE-2026-41879","state":"PUBLISHED","title":"Weak password hashing in R-SOFT DMS","description":"R-SOFT DMS stores superadmin credentials using a non-salted nested MD5 hash. This allows an attacker who obtain password hash to decode superadmin credentials. Critically, this password cannot be changed except by modifying the configuration file.\n\nThis issue was fixed in version v3.17-2000.","publishedAt":"2026-07-10T09:05:47.551Z","updatedAt":"2026-07-10T10:19:29.636Z","severity":{"score":8.2,"label":"High","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","source":"CERT-PL"},"assigner":"CERT-PL","products":["R-SOFT SERWIS DMS"],"affected":[{"vendor":"R-SOFT SERWIS","product":"DMS","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"v3.17-2000","versionType":"custom"}]}],"references":["https://cert.pl/posts/2026/07/CVE-2026-41876"],"weaknesses":["CWE-328"],"ingestedAt":"2026-10-29T20:11:57.932Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/41xxx/CVE-2026-41879.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-41879","state":"PUBLISHED","datePublished":"2026-07-10T09:05:47.551Z","dateUpdated":"2026-07-10T10:19:29.636Z","assignerShortName":"CERT-PL","assignerOrgId":"4bb8329e-dd38-46c1-aafb-9bf32bcb93c6","dateReserved":"2026-04-22T11:32:15.204Z"},"containers":{"cna":{"title":"Weak password hashing in R-SOFT DMS","descriptions":[{"lang":"en","value":"R-SOFT DMS stores superadmin credentials using a non-salted nested MD5 hash. This allows an attacker who obtain password hash to decode superadmin credentials. Critically, this password cannot be changed except by modifying the configuration file.\n\nThis issue was fixed in version v3.17-2000."}],"affected":[{"vendor":"R-SOFT SERWIS","product":"DMS","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"v3.17-2000","versionType":"custom"}]}],"references":[{"url":"https://cert.pl/posts/2026/07/CVE-2026-41876","tags":["third-party-advisory"]}],"metrics":[{"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}],"cvssV4_0":{"attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","subIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","version":"4.0","baseSeverity":"HIGH","baseScore":8.2,"vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-328","lang":"en","description":"CWE-328 Use of Weak Hash","type":"CWE"}]}],"providerMetadata":{"shortName":"CERT-PL","orgId":"4bb8329e-dd38-46c1-aafb-9bf32bcb93c6","dateUpdated":"2026-07-10T09:05:47.551Z"},"credits":[{"lang":"en","value":"Marek Figielski (Vanilla.pl)","type":"finder"}],"source":{"discovery":"EXTERNAL"},"x_generator":{"engine":"Vulnogram 0.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-07-10T10:19:06.995124Z","id":"CVE-2026-41879","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-07-10T10:19:29.636Z"}}]}}}