CVE-2025-58385: User impersonation, data exfiltration

The security update v6.1.1 is available.
Refer to the Security Update page for more information. 

Context

Vulnerability affecting Watchdoc versions prior to 6.1.1 allowing user impersonation when using PUK codes for login.

When Active Directory users’ PUK codes are automatically generated by Watchdoc, it is possible to understand the generation algorithm and replicate it to generate the PUKs of all AD users.

Impacts

Information integrity breach: possibility to impersonate any user, access their print queue, or scan on their behalf.

Mitigation or remediation proposals

Mitigation: use an AD attribute containing a random PUK code.

 

Remediation: replace PUK code authentication with login/PIN code authentication.

CVE Description

Vulnerability type	CWE - CWE-798: Use of Hard-coded Credentials (4.16) CWE - CWE-1241: Use of Predictable Algorithm in Random Number Generator (4.16)
Affected product(s) and version(s)	Watchdoc up to at least 6.1.0.5094
Fixed version(s)	Watchdoc 6.1.1
Attack type	Local
Vulnerability impact	User impersonation (spoofing), Confidentiality breach
CVSS 4.0 Vector	CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N
CVSS 4.0 Score	CVSS v4.0 Score: 6.9