CVE-2017-11131

CVE-2017-11131 describes a critical authentication vulnerability in heinekingmedia StashCat across Android, Web, and Desktop versions up to 1.7.5, 0.0.80w, and 0.0.86 respectively. The flaw stems from the direct SHA-512 hashing of user passwords without salting or proper key derivation, compounded by only using the first 32 bytes of the hash. This design significantly weakens password security, making it susceptible to dictionary and rainbow table attacks if an attacker obtains the password hash. Rated as MEDIUM severity with a CVSS score of 5.9, this vulnerability (CWE-916) presents a high confidentiality impact (C:H) due to the ease of cracking compromised password hashes. The attack complexity is high (AC:H) as it requires prior access to the password hash, but no user interaction (UI:N) is needed once the hash is acquired. Currently, there is no evidence of active exploitation, and no public exploit code (Metasploit, Nuclei, ExploitDB) or KEV catalog entry exists. Community discussion and media coverage for this CVE are minimal, indicating low public awareness and attention.