The sensitive routine for generating salts in Crypt::PasswdMD5 uses Perl’s built‑in rand function, which is deterministic and unsuitable for cryptographic applications. The affected module versions therefore produce salts with very low entropy, making the resulting password hashes vulnerable to pre‑computed or rainbow‑table attacks. An attacker who can observe or predict the salt values can significantly reduce the effort required to crack stored passwords, potentially compromising user accounts and data confidentiality. This flaw is classified as CWE‑338: Predictable Random Number Generation.

The vulnerability affects the RSAVAGE Crypt::PasswdMD5 module for Perl, in all versions up through 1.42 inclusive. Any Perl installation or application that relies on this module to store or verify passwords is at risk.

Because the flaw resides in a library function that is automatically called whenever a password hash is created, the exploitability is high for any environment that imports or uses Crypt::PasswdMD5. The CVSS score is 7.5, indicating a high severity, and the exploitability of generating predictable salts exposes stored credentials to pre‑computation attacks. EPSS is not available and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is code execution that imports the vulnerable module and generates password hashes.