Redeight CMS version 1.0 stores user passwords using the MD5 algorithm without a salt. Because MD5 is a cryptographically broken hash function and the passwords are not salted, attackers who obtain the password hashes can trivially recover the plaintext credentials by using rainbow tables. This vulnerability is categorized as CWE-328, reflecting the weak hashing algorithm used for password storage.

The affected product is Redeight CMS manufactured by Redeight, specifically version 1.0.

The CVSS score of 5.9 indicates a moderate severity, and the EPSS score is not available so precise exploitation likelihood cannot be quantified. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker must gain access to the stored password hashes—either through database compromise or exported password data—to launch an attack, after which rainbow tables can quickly reveal the plaintext passwords. While the exploitation requires having the hashes, the lack of salting and weak cryptography make the attack trivial once the hashes are in hand.