Weak Hash Vulnerability in Vaelsys 4.1.0 MD4 Hash Handler
CVE-2025-8260
Key Information:
Badges
What is CVE-2025-8260?
A vulnerability has been identified in the Vaelsys product, specifically in the MD4 Hash Handler located in the /grid/vgrid_server.php file. This issue arises from manipulating the argument 'xajaxargs', which can lead to the implementation of weak hash functions. Such exploitation can potentially allow attackers to initiate remote attacks, compromising the security of the system. The nature of the vulnerability suggests that while the complexity of executing an attack is high, the risk remains significant, particularly since the exploit details have been made public, and the vendor has not responded to reports concerning the issue.
Affected Version(s)
Vaelsys 4.1.0
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.
References
CVSS V4
Timeline
- 🟡
Public PoC available
- 👾
Exploit known to exist
Vulnerability published
Vulnerability Reserved