CVE-2025-32874 Weak cryptography in n/a
Attackers can decrypt stored passwords due to deterministic encryption with hardcoded keys and static salts in Kaseya Network Detective.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2025-32874?
CVE-2025-32874 is a high-severity vulnerability in n/a, published on 16 Jul 2025. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
An issue was discovered in Kaseya Rapid Fire Tools Network Detective through 2.0.16.0. A vulnerability exists in the EncryptionUtil class because symmetric encryption is implemented in a deterministic and non-randomized fashion. The method Encrypt(byte[] clearData) derives both the encryption key and the IV from a fixed, hardcoded input by using a static salt value. As a result, identical plaintext inputs always produce identical ciphertext outputs. This is true for both FIPS and non-FIPS generated passwords. In other words, there is a cryptographic implementation flaw in the password encryption mechanism. Although there are multiple encryption methods grouped under FIPS and non-FIPS classifications, the logic consistently results in predictable and reversible encrypted outputs due to the lack of per-operation randomness and encryption authentication.
Weakness: CWE-326
Which versions are affected by CVE-2025-32874?
How do I fix CVE-2025-32874?
No fix has been published for CVE-2025-32874 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-32874 being exploited?
There is no known exploitation of CVE-2025-32874 in the wild and no public exploit code.
Sources
Also known as GHSA-fm6w-39g9-r4vh.