Insecure Password Hashing in EzGED3 by Ballpoint

CVE-2025-51540

What is CVE-2025-51540?

EzGED3 version 3.5.0 suffers from an insecure password hashing implementation where user passwords are stored using an outdated and cryptographically weak scheme: md5(md5(password)). This vulnerability exposes user credentials to potential offline brute-force attacks if password hashes are leaked. The absence of salting combined with the use of a fast hashing algorithm facilitates attackers' ability to recover plaintext passwords through effective means like precomputed rainbow tables or GPU-accelerated cracking tools. The vendor has addressed this issue in subsequent updates, specifically in version 3.5.72.27183.

References