hosp_order EUVD-2026-85626

Exploitation is not self-contained: an attacker must FIRST gain access to the stored password hashes (via a separate vulnerability, database compromise, or backup leak), because the flaw is that MD5.getMD5 stores user passwords as unsalted MD5 digests rather than exposing any remotely-triggerable primitive. This is why the CVSS vector uses AC:H (difficult) and PR:L. The limiting factor is high - no impact until the hash store is exfiltrated; on its own the weakness only lowers the cost of cracking already-stolen hashes. No fixed release exists due to the rolling-release model, so remediation requires the operator to change the hashing code (add salt / adopt a strong KDF like bcrypt/argon2).

This is a genuinely low-priority finding, and the signals agree. The CVSS 4.0 base score is 1.3 (Low), with vector AV:N/AC:H/PR:L/UI:N and only VC:L (low confidentiality impact, no integrity or availability). VulDB's exploit-maturity flag is E:P (proof-of-concept) and a POC is referenced via GitHub issue #123, but POC existence is NOT active exploitation - there is no CISA KEV listing and no EPSS score provided. The core issue (CWE-325, unsalted one-way MD5 hashing of user passwords in MD5.getMD5) is a design/crypto-hygiene weakness rather than a directly exploitable primitive: it only has value AFTER an attacker has already obtained the stored password hashes through some other vector, at which point unsalted MD5 makes offline rainbow-table/precomputed-hash cracking trivial. This dependency is exactly why VulDB assigns AC:H ('a high degree of complexity is needed... exploitability is described as difficult'). Note a minor internal tension: the description says 'the attack may be initiated remotely' (AV:N) yet the weakness is not remotely triggerable on its own - AV:N here reflects that the vulnerable web app is network-facing, not that unsalted hashing is a remote exploit. Overall: low real-world risk, defense-in-depth hardening rather than an urgent patch item.

An attacker who has separately obtained the application's user-password table (e.g. via SQL injection, a leaked backup, or the hard-coded DB credentials tracked in sibling CVE-2026-96548) finds passwords stored as unsalted MD5 digests. Because no per-user salt is applied, the attacker runs precomputed rainbow tables or GPU brute-force against the digests and recovers plaintext passwords far faster than salted storage would allow. A proof-of-concept was published in GitHub issue #123, but no active exploitation is reported.