CVE-2025-57784

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2025-57784

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-57784.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2025-57784

Published

2026-01-26T17:47:19.382Z

Modified

2026-07-15T01:48:53.272858791Z

Severity

4.0 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CVSS Calculator

Summary

Tomahawk authentication timing attack due to usage of 'strcmp'

Details

Tomahawk auth timing attack due to usage of strcmp has been identified in Hiawatha webserver version 11.7 which allows a local attacker to access the management client.

Database specific

{
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "11.7"
                },
                {
                    "last_affected": "8.5"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/57xxx/CVE-2025-57784.json",
    "cna_assigner": "certcc"
}

References

Affected packages

Git / gitlab.com/hsleisink/hiawatha

Affected ranges

Type

GIT

Repo

https://gitlab.com/hsleisink/hiawatha

Events

Introduced

1f0f79b6cb108a593123a74ad7c9fd1ad36a9253

Last affected

1f0f79b6cb108a593123a74ad7c9fd1ad36a9253

Database specific

{
    "extracted_events": [
        {
            "introduced": "11.7"
        },
        {
            "last_affected": "11.7"
        }
    ],
    "cpe": "cpe:2.3:a:hiawatha-webserver:hiawatha:11.7:*:*:*:*:*:*:*",
    "source": "CPE_STRING"
}

Affected versions

11.*

11.7

v11.*

v11.7

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-57784.json"