Type Confusion Vulnerability in ZendTo by Zend Technologies
CVE-2025-32352

4.8MEDIUM

Key Information:

Vendor

Zend

Status
Zendto
Vendor
CVE Published:
5 April 2025

What is CVE-2025-32352?

A type confusion vulnerability in the NSSAuthenticator component of ZendTo allows remote attackers to exploit authentication processes. This flaw primarily affects versions prior to v5.04-7, where user passwords stored as MD5 hashes can be misinterpreted as numerical values, leading to potential authentication bypass. Transitioning from MD5 to the more secure bcrypt hashing algorithm is essential to mitigate this issue and protect user data effectively.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

ZendTo 0 < 5.04-7

References

https://projectblack.io/blog/zendto-nday-vulnerabilities/

CVSS V3.1

Score:
4.8
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.