Weak Password Hashing in PIMBoards Enables Local Brute-Force Privilege Escalation
AI analysis
CVE-2026-81822 is a weak-cryptography flaw (CWE-327) in PIMBoards: users' app-native passwords are stored in project files using a hashing scheme susceptible to computational brute-forcing. An attacker who gains read access to PIMBoards project files (rated as a local attack vector requiring only low privileges and no user interaction) can extract the stored hashes and crack them offline. Recovering a password can potentially elevate the attacker to a PIMBoards administrator account, with high confidentiality impact on the system and subsequent systems per the CVSS 4.0 vector. Any deployment where unauthorized users, shared storage, or backups expose PIMBoards project files is affected; the source data does not specify affected versions or ranges. There is no known exploitation: the flaw has a 0.1% EPSS score (1st percentile), no public proof-of-concept, and is not listed in CISA KEV.
What to do: Restrict read access to PIMBoards project files via file-system permissions, shared-folder ACLs, and backup placement so only authorized users can reach the stored hashes, and require long, strong app-native passwords to make brute-forcing impractical. No fixed version is specified in the source data, so monitor CISA ICS-CERT and the vendor for a patched release, and rotate any passwords whose hashes may have been exposed in project files.
Estimated exposure
—No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
The vulnerability, if exploited, could allow a miscreant with read access to PIMBoards project files to reverse engineer PIMBoards users’ app-native passwords through computational brute-forcing of weak hashes, potentially allowing elevation to a PIMBoards administrator user.