CVE-2026-41879highCWE-328

CVE-2026-41879: high-severity vulnerability in R-SOFT SERWIS DMS

Weak password hashing in R-SOFT DMS

Published

Follow this CVE+ Monitor DMS

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.2epss 0.3%
R-SOFT DMS stores superadmin credentials using a non-salted nested MD5 hash. This allows an attacker who obtain password hash to decode superadmin credentials. Critically, this password cannot be changed except by modifying the configuration file. This issue was fixed in version v3.17-2000.
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Affected products
R-SOFT SERWIS · DMS
Related CVEs — R-SOFT SERWIS DMS

In the same product, most dangerous first.

CVE-2026-41880CRITICALOS Command Injection in R-SOFT DMSEPSS 1.3%CVE-2026-41876HIGHOS Command Injection in R-SOFT DMSEPSS 1.2%CVE-2026-41878HIGHInsecure Direct Object Reference in R-SOFT DMSEPSS 0.5%CVE-2026-41877MEDIUMStored XSS in R-SOFT DMSEPSS 0.4%