CVE-2025-57784 — Tomahawk authentication timing attack due to usage of 'strcmp'

CVE-2025-57784

Tomahawk authentication timing attack due to usage of 'strcmp' PUBLISHED

Description (CNA)

Tomahawk auth timing attack due to usage of `strcmp` has been identified in Hiawatha webserver version 11.7 which allows a local attacker to access the management client.

Affected (CNA)

Vendor / product	Versions
Hiawatha / Hiawatha Web server	affected 11.7 through 8.5

CWE

No CWE identifiers supplied.

References

https://gitlab.com/hsleisink/hiawatha/-/blame/master/src/tomahawk.c?ref_type=heads#L429

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.