Pathways Homecare 6.5 uses weak encryption for user names and passwords, which allows local users to gain privileges by recovering the pass…

Published 24 y ago 2001-12-31 · modified 4 mo ago 2026-06-16 · JSON

CVSS

7.8

v3.1 · CNA

CISA KEV

not known exploited

EPSS

0.4%

percentile 36%

Public exploits

Exploit-DB

Pathways Homecare 6.5 uses weak encryption for user names and passwords, which allows local users to gain privileges by recovering the passwords from the pwhc.ini file.

CISA SSVC assessment

Exploitation: none
Automatable: no
Technical impact: total
Assessed: 21 mo ago 2025-01-16

Exploit prediction (EPSS)

0.41% probability of exploitation in the next 30 days, higher than 36% of all scored CVEs.

Exploits and detections

EDB-21173 McKesson Pathways Homecare 6.5 - Weak 'Username' and Password Encryption · local · 2001-12-07

CVSS scores

Assigned by	Version	Score	Vector
CISA ADP	3.1	7.8	`CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`
NVD	3.1	7.8	`CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`
CNA	3.1	7.8	`CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`
NVD	2.0	4.6	`AV:L/AC:L/Au:N/C:P/I:P/A:P`

Classification

Weakness

CWE-326 Inadequate Encryption Strength

References

iss.net /security_center/static/7682.php · vdb-entry, x_refsource_XF, x_transferred
securityfocus.com /bid/3653 · vdb-entry, x_refsource_BID, x_transferred
securityfocus.com /archive/1/244367 · mailing-list, x_refsource_BUGTRAQ, x_transferred

Sources

CVE List: CVE-2001-1546
NVD: CVE-2001-1546

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.

Summary