CVE-2025-47276 - CVE House
Back to Database
Status published High CVE-2025-47276

Actualizer Uses OpenSSL's "-passwd" Function Which Uses SHA512 Under The Hood Instead of Proper Password Hasher like Yescript/Argon2i

Vulnerability Description

Actualizer is a single shell script solution to allow developers and embedded engineers to create Debian operating systems (OS). Prior to version 1.2.0, Actualizer uses OpenSSL's "-passwd" function, which uses SHA512 instead of a more suitable password hasher like Yescript/Argon2i. All Actualizer users building a full Debian Operating System are affected. Users should upgrade to version 1.2.0 of Actualizer. Existing OS deployment requires manual password changes against the alpha and root accounts. The change will deploy's Debian's yescript overriding the older SHA512 hash created by OpenSSL. As a workaround, users need to reset both `root` and "Alpha" users' passwords.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-47276

Credits & Attribution

No credits recorded in the NVD database.

References

More from ChewKeanHo

View All →
CVE-2023-42798
AutomataCI Release Job Can Revert Repo to First Commit
High 8.2

Affected Vendor

Affected Software

Actualizer
Vulnerable Versions:
< 1.2.0

Timeline

Official Publish: May 13th, 2025
Last Modified: May 13th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weaknesses (CWE)

CWE-328

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.