Weak password hashing in SH3 Módulo de Gestão/Módulo de Arrecadação
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- None
- Attack complexity
- High
- Attack requirements
- None
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-326.
Summary
The SH3 Módulo de Gestão/Módulo de Arrecadação component stores password hashes computed with insufficient computational effort (CWE-916). A remote attacker with high privileges can exploit this only with high attack complexity. A public exploit has been disclosed and is linked in the references.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
Description from the CNA
A security vulnerability has been detected in SH3. This affects an unknown function of the component Módulo de Gestão/Módulo de Arrecadação. The manipulation leads to password hash with insufficient computational effort. The attack is possible to be carried out remotely. A high degree of complexity is needed for the attack. The exploitability is reported as difficult. The exploit has been disclosed publicly and may be used. Upgrading to version 2026.0.2.0 mitigates this issue. Upgrading the affected component is recommended.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | SH3 | all versions | — | No fix listed | CNA |
- SH3 Vendor— Affected all versions Fixed in — No fix listed CNA
CPE names CNA · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:sh3:sh3:*:*:*:*:*:*:*:* | — | — | — |
- cpe:2.3:a:sh3:sh3:*:*:*:*:*:*:*:* Versions — — ·—
Remediation
Upgrading SH3 to version 2026.0.2.0 mitigates this issue, and upgrading the affected component is recommended.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
Timeline
- 2026-10-25 Threatist record created from CVE-2026-116054
- 2026-10-27 Alias added: GHSA-hrh2-6gcc-h3rw
- 2026-10-29 CISA SSVC decision points changed
- 2026-10-29 Priority changed: LOW → MEDIUM
References
Sources
- CVE-2026-116054 · CVE Program
- CVE-2026-116054 · NVD
- FIRST EPSS
- GHSA-hrh2-6gcc-h3rw · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences