The flaw is a fail‑open password validation in the shell installer script. The script invokes mkpasswd to generate yescrypt password hashes but ignores the command’s exit status; if mkpasswd fails—because the implementation is incompatible or the environment lacks yescrypt support—the resulting hash variable is empty and the build proceeds. The root and alpha accounts therefore end up with empty password fields. Depending on the system’s authentication configuration, this can allow login without a password. The weakness corresponds to unchecked return value (CWE‑252) and partial input validation (CWE‑636). The impact is that an attacker could gain unauthorized root or privileged access to an image or system that uses the compromised installer.

The affected product is Chew Kean Ho software‑actualizer version 1.2.0 and all earlier releases. No other vendors or products are listed.

The CVSS score of 7.9 reflects moderate‑to‑high severity. The EPSS score is not available, and the vulnerability is not listed in CISA KEV. The likely attack surface is the build or deployment process: an attacker who can control the installer execution or supply a custom mkpasswd binary could cause the hash to be empty and thus create an image with passwordless root or alpha accounts. Anyone who signs or distributes such an image may unwittingly expose themselves to root compromise. The risk is therefore significant for images used in production environments.