CVE-2025-2265
Published: 13 March 2025
Summary
CVE-2025-2265 is a high-severity Use of Password Hash With Insufficient Computational Effort (CWE-916) vulnerability. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Credentials In Files (T1552.001); ranked at the 19.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-6 (Least Privilege) and IA-5 (Authenticator Management).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly requires management of authenticators with sufficient strength of mechanism and protection from unauthorized disclosure, addressing the flawed zero-padding, SHA1 hashing, and truncation in password storage.
Mandates identification, reporting, testing, and timely installation of updates to remediate flaws like the truncated password hash storage in Sante PACS Server.exe.
Enforces least privilege to prevent low-privilege local attackers from accessing the SQLite HTTP.db containing the vulnerable password hashes.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability is a flawed password hashing/storage mechanism (truncation on zero bytes in SHA1 hash) in an application database file, directly enabling local attackers to compromise and recover web user credentials.
NVD Description
The password of a web user in "Sante PACS Server.exe" is zero-padded to 0x2000 bytes, SHA1-hashed, base64-encoded, and stored in the USER table in the SQLite database HTTP.db. However, the number of hash bytes encoded and stored is truncated if…
more
the hash contains a zero byte
Deeper analysisAI
CVE-2025-2265 is a vulnerability in Sante PACS Server.exe, published on 2025-03-13, affecting the password storage mechanism for web users. Passwords are zero-padded to 0x2000 bytes, SHA1-hashed, base64-encoded, and stored in the USER table of the SQLite database HTTP.db. However, if the hash contains a zero byte, the number of encoded and stored hash bytes is truncated, as associated with CWE-916. The issue has a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
The vulnerability can be exploited by a local attacker with low privileges (PR:L), requiring low attack complexity and no user interaction. Successful exploitation enables high-impact consequences on confidentiality, integrity, and availability, potentially allowing the attacker to compromise user credentials or escalate control over the affected system due to the flawed hashing process.
Mitigation details are provided in the Tenable research advisory at https://www.tenable.com/security/research/tra-2025-08.
Details
- CWE(s)