The use of the insecure MD5 cryptographic algorithm in AndSoft e-TMS v25.03 poses a significant risk of credential exposure through collision attacks.

This vulnerability involves the use of a broken or risky cryptographic algorithm, specifically MD5, for password encryption. Because the algorithm is cryptographically weak, unauthenticated attackers can leverage modern hardware to perform collision attacks and recover plaintext credentials.

The reliance on a deprecated hashing algorithm like MD5 introduces a high risk of unauthorized access to user accounts. With a CVSS score of 7.5, the vulnerability is classified as High severity, indicating that successful exploitation could lead to widespread credential compromise, potential data breaches, and significant loss of user confidentiality.

Immediate Action: Update the AndSoft e-TMS installation to patch versions VNL 25001 or VNL 25010 immediately to transition to a secure hashing mechanism.

Proactive Monitoring: Monitor system logs for unusual authentication patterns or failed login attempts that might suggest an attacker is testing the integrity of the hashed password database.

Compensating Controls: Implement strict network access controls to restrict access to the application server and ensure all traffic is encrypted via TLS to prevent interception of sensitive data during transit.

Public Exploit Available: No — there is no confirmed public exploit in the available data.

Given the inherent weakness of the MD5 algorithm, it is imperative that organizations running AndSoft e-TMS v25.03 apply the vendor-supplied patches (VNL 25001 or VNL 25010) as soon as possible. Failure to remediate this vulnerability leaves user credentials vulnerable to decryption, which can lead to further unauthorized access across the enterprise environment.