CVE-2025-54338
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
An Incorrect Access Control vulnerability was found in the Application Server of Desktop Alert PingAlert version 6.1.0.11 to 6.1.1.2 which allows an attacker to disclose user hashes.
Risk Assessment
An attacker may obtain user password hashes, potentially facilitating password cracking and subsequent account takeover. The risk affects organizations using vulnerable PingAlert versions.
Recommendation
Update Desktop Alert PingAlert to a version later than 6.1.1.2 or apply the vendor fix. If a leak is suspected, consider forcing user password resets.
Other vulnerabilities in Desktop Alert PingAlert
See all- CVE-2025-54347Critical
In Application Server of Desktop Alert PingAlert (versions 6.1.0.11 to 6.1.1.2), a Directory Traversal vulnerability allows an attacker to write arbitrary files under certain conditions.
- CVE-2025-54343Critical
An Incorrect Access Control vulnerability was found in the Application Server of Desktop Alert PingAlert version 6.1.0.11 to 6.1.1.2 exploitable remotely for Escalation of Privileges.
- CVE-2025-54339Critical
An Incorrect Access Control vulnerability was found in the Application Server of Desktop Alert PingAlert versions 6.1.0.11 to 6.1.1.2. It is remotely exploitable for escalation of privileges.
- CVE-2025-54563High
An Incorrect Access Control vulnerability was found in the Application Server of Desktop Alert PingAlert version 6.1.0.11 to 6.1.1.2 which allows Incorrect Access Control, leading to Remote Information Disclosure.
- CVE-2025-54341Medium
Hard-coded configuration values exist in the Application Server of Desktop Alert PingAlert versions 6.1.0.11 to 6.1.1.2. This may lead to disclosure of sensitive information or facilitate exploitation by attackers.
- CVE-2025-54562Medium
A vulnerability was found in the Application Server of Desktop Alert PingAlert version 6.1.0.11 to 6.1.1.2 which allows technical information to be disclosed through stack traces.
- CVE-2025-54561Medium
An Incorrect Access Control vulnerability in the Application Server of Desktop Alert PingAlert versions 6.1.0.11 to 6.1.1.2 allows remote access to content without proper permissions due to a Broken Authorization Schema.
- CVE-2025-54560Low
A Server-side Request Forgery vulnerability was found in the Application Server of Desktop Alert PingAlert versions 6.1.0.11 to 6.1.1.2. It allows probing of internal infrastructure.
- CVE-2025-54559Low
An issue was found in the Application Server of Desktop Alert PingAlert versions 6.1.0.11 to 6.1.1.2 that allows remote Path Traversal for loading arbitrary external content. An attacker could read or load files outside the intended directory.
- CVE-2025-54348Medium
A Stored Cross Site Scripting (XSS) vulnerability was found in the Application Server of Desktop Alert PingAlert versions 6.1.0.11 to 6.1.1.2. It allows an attacker to hijack a user's browser and capture sensitive information.
Original NVD description (English source)
An Incorrect Access Control vulnerability was found in the Application Server of Desktop Alert PingAlert version 6.1.0.11 to 6.1.1.2 which allows an attacker to disclose user hashes.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS