CVE-2025-59745
📋 TL;DR
This vulnerability in AndSoft's e-TMS v25.03 uses the MD5 hash algorithm for password encryption, which is cryptographically broken and vulnerable to collision attacks. Attackers could potentially crack stored passwords to gain unauthorized access to user accounts. All systems running the affected version are at risk.
💻 Affected Systems
- AndSoft e-TMS
📦 What is this software?
E Tms by Andsoft
⚠️ Risk & Real-World Impact
Worst Case
Attackers crack all MD5-hashed passwords, gain administrative access, compromise sensitive data, and potentially pivot to other systems.
Likely Case
Attackers with access to password databases crack weak passwords to gain unauthorized user access and potentially escalate privileges.
If Mitigated
With proper network segmentation and monitoring, impact is limited to credential exposure requiring additional authentication bypass.
🎯 Exploit Status
Exploitation requires access to password database or hash values, but MD5 cracking tools are widely available and effective.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Not specified
Vendor Advisory: https://www.incibe.es/en/incibe-cert/notices/aviso/update-24092025-multiple-vulnerabilities-andsofts-e-tms
Restart Required: No
Instructions:
1. Contact AndSoft for updated version or patch. 2. Apply vendor-provided fix. 3. Force password resets for all users after patching.
🔧 Temporary Workarounds
Password Policy Enhancement
allEnforce strong password policies to make MD5 cracking more difficult
Network Segmentation
allIsolate e-TMS systems from untrusted networks
🧯 If You Can't Patch
- Implement multi-factor authentication for all e-TMS access
- Monitor for unusual authentication patterns and failed login attempts
🔍 How to Verify
Check if Vulnerable:
Check if e-TMS version is 25.03 and examine password storage mechanism for MD5 usageCheck Version:
Check application interface or configuration files for version informationVerify Fix Applied:
Verify updated version no longer uses MD5 for password hashing and uses stronger algorithm like bcrypt or Argon2📡 Detection & Monitoring
Log Indicators:
- Multiple failed login attempts followed by successful login
- Unusual user access patterns
- Administrative actions from non-admin accounts
Network Indicators:
- Unusual database access patterns
- Traffic to known password cracking services
SIEM Query:
source="e-tms" AND (event_type="authentication" AND result="success") | stats count by user | where count > threshold