Read the docs
TI-2025-05348 Aliases CVE-2025-5922GHSA-xfj9-9qw7-7cmr

Retrievable password hash protecting TSplus admin console

Priority LOW 21CWE-522Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Information disclosure
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-522.

Summary

Access to TSplus Remote Access Admin Tool is restricted to administrators (unless "Disable UAC" option is enabled) and requires a PIN code. In versions below v18.40.6.17 the PIN's hash is stored in a system registry accessible to regular users, making it possible to perform a brute-force attack using rainbow tables, since the hash is not salted. LTS (Long-Term Support) versions also received patches in v17.2025.6.27 and v16.2025.6.27 releases.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00097 0th percentileScored 2026-11-07
Fix Fixed TSplus Remote Access (TSplus): v18.40.6.17, v17.2025.6.27, v16.2025.6.27

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
TSplusTSplus Remote Accessbefore v18.40.6.17; before v17.2025.6.27; before v16.2025.6.27v18.40.6.17, v17.2025.6.27, v16.2025.6.27Patch availableCNA
  • TSplus Remote Access VendorTSplus Affected before v18.40.6.17; before v17.2025.6.27; before v16.2025.6.27 Fixed in v18.40.6.17, v17.2025.6.27, v16.2025.6.27 Patch available CNA

Remediation

  • Fix · CNA TSplus Remote Access (TSplus) Fixed in v18.40.6.17, v17.2025.6.27, v16.2025.6.27

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-5922
  2. 2026-10-03 Alias added: GHSA-xfj9-9qw7-7cmr

References

Other 1

  • TI-2023-14796 An issue was discovered in TSplus Remote Access through 16.0.2.14. CVSS 3.1CRITICAL 9.8
  • TI-2023-14795 An issue was discovered in TSplus Remote Access through 16.0.2.14. CVSS 3.1CRITICAL 9.8
  • TI-2023-14794 An issue was discovered in TSplus Remote Access through 16.0.2.14. CVSS 3.1CRITICAL 9.8
  • TI-2023-11941 TSplus Remote Work 16.0.0.0 has weak permissions for .exe, .js, and .html files under the… CVSS 3.1CRITICAL 9.8
  • TI-2023-11940 TSplus Remote Work 16.0.0.0 places a cleartext password on the "var pass" line of the… CVSS 3.1CRITICAL 9.8
  • TI-2025-19291 hb.exe in TSplus Remote Access before 17.30 2024-10-30 allows remote attackers to… CVSS 3.1MEDIUM 5.8
See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences