CVE-2025-57784: Hiawatha-Webserver Hiawatha

Low severity, CVSS 3.3. EPSS: 0.2% chance of exploitation in the next 30 days.

Tomahawk auth timing attack due to usage of `strcmp` has been identified in Hiawatha webserver version 11.7 which allows a local attacker to access the management client.

Affected products

• Hiawatha-Webserver Hiawatha: version 11.7 only

Published 2026-01-26. Last modified 2026-06-17.