PT-2025-15053 · Zendto · Zendto

Published 2025-04-05 · Updated 2025-04-05 · CVE-2025-32352

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions ZendTo versions prior to 5.04-7

Description A type confusion vulnerability in lib/NSSAuthenticator.php allows remote attackers to bypass authentication for users with passwords stored as MD5 hashes that can be interpreted as numbers. The solution requires moving from MD5 to bcrypt.

Recommendations For versions prior to 5.04-7, migrate from MD5 to bcrypt to resolve the issue. As a temporary workaround, consider restricting access to the lib/NSSAuthenticator.php file until a patch is available. Avoid using MD5 hashes for password storage in the affected API endpoints until the issue is resolved.

Exploit

Fix

Type Confusion

Weakness Enumeration

CWE-843

Related Identifiers

CVE-2025-32352

Affected Products

Zendto

References · 8

• 🔥 https://projectblack.io/blog/zendto-nday-vulnerabilities · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-32352 · Security Note
• https://t.me/cvedetector/22184 · Telegram Post
• https://t.me/cvenotify/117930 · Telegram Post
• https://t.me/cvetracker/20882 · Telegram Post
• https://twitter.com/CVEnew/status/1908438439818662318 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1908419024549015960 · Twitter Post
• https://t.me/cvenotify/117932 · Telegram Post