Raw vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XSummary
CVE-2026-57310 is a medium-severity Use of Password Hash With Insufficient Computational Effort (CWE-916) vulnerability in Cert (inferred from references). Its CVSS base score is 6.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Password Cracking (T1110.002); ranked at the 7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-45944
- 🇵🇱 CERT-PL: cert.pl
Vulnerability Data
Windu CMS uses hashing algorithm based on MD5 and SHA1 with static salt to store user passwords. This allows an attacker who obtain password hash to decode user credentials. Because vendor contact attempts were unsuccessful, the vulnerability has only been…
more
confirmed in version 4.1 but may also affect other versions.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Weak password hashing (MD5+SHA1, static salt) directly enables offline password cracking of obtained hashes.
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V11.4.2
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Information from security contacts highlights password hashing methods with insufficient computational effort, preventing their adoption.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Proper password hashing is a direct instance of using cryptographic hashes to protect data-at-rest.
Secure development practices explicitly include selection and configuration of strong, computationally expensive password hashes.
Authentication policies may reference password handling but do not address storage or computational cost of hashes.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Requires secure handling of authentication information, which includes choosing strong password hashing schemes.
Requires appropriate use of cryptography, which encompasses selecting strong hashing algorithms for passwords.
Secure coding practices include implementing password storage with adequate computational effort.
Mandates secure authentication mechanisms, directly addressing the need for computationally strong password hashes.