Type Confusion Vulnerability in ZendTo by Zend Technologies
CVE-2025-32352

4.8MEDIUM

Key Information:

Vendor

Zend

Status
Zendto
Vendor
CVE Published:
5 April 2025
đź”” Create Zend Vulnerability Alert

What is CVE-2025-32352?

A type confusion vulnerability in the NSSAuthenticator component of ZendTo allows remote attackers to exploit authentication processes. This flaw primarily affects versions prior to v5.04-7, where user passwords stored as MD5 hashes can be misinterpreted as numerical values, leading to potential authentication bypass. Transitioning from MD5 to the more secure bcrypt hashing algorithm is essential to mitigate this issue and protect user data effectively.

Affected Version(s)

ZendTo 0 < 5.04-7

References

https://projectblack.io/blog/zendto-nday-vulnerabilities/

CVSS V3.1

Score:
4.8
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.