Medium severity · published Jul 29, 2025
CVE-2025-5922
Retrievable password hash protecting TSplus admin console
4.8
CVSS
0.1%
EPSS
No
On KEV
Description
Access to TSplus Remote Access Admin Tool is restricted to administrators (unless "Disable UAC" option is enabled) and requires a PIN code. In versions below v18.40.6.17 the PIN's hash is stored in a system registry accessible to regular users, making it possible to perform a brute-force attack using rainbow tables, since the hash is not salted.
LTS (Long-Term Support) versions also received patches in v17.2025.6.27 and v16.2025.6.27 releases.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.1% · higher than 1% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TR
TSplus Remote Access · TSplus
before v18.40.6.17; before v17.2025.6.27; before v16.2025.6.27 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-5922
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-5922
cert.pl
https://cert.pl/en/posts/2025/07/CVE-2025-5922
More from TSplus Remote Access
9.8
CVE-2023-31067
An issue was discovered in TSplus Remote Access through 16.0.2.14
8.7
CVE-2026-108071
Improper Multi-Factor Authentication Validation Allows Authentication Bypass
8.7
CVE-2026-108070
Improper Access Control Allows Unauthorized Access to Protected Internal Web Resources in TSplus Remote Access
5.8
CVE-2025-26318
hb.exe in TSplus Remote Access before 17.30 2024-10-30 allows remote attackers to retrieve a list of all domain accounts currently connected to the application
5.4
CVE-2026-108072
Insecure Permissions on Shared Startup Scripts Allow Cross-User Code Execution and Potential Privilege Escalation