Common Weakness Enumeration
Show details on NVD website
Show details on NVD website
Show details on NVD website
Show details on NVD website
Show details on NVD website
Show details on NVD website
Show details on NVD website
Show details on NVD website
Show details on NVD website
Show details on NVD website
Back to CWE stats page
CWE-288
Authentication Bypass Using an Alternate Path or Channel
The product requires authentication, but the product has an alternate path or channel that does not require authentication.
CVE-2025-1638 (GCVE-0-2025-1638)
Vulnerability from cvelistv5 – Published: 2025-03-01 07:24 – Updated: 2026-04-08 16:56
VLAI
Title
Alloggio Membership <= 1.1 - Authentication Bypass via Social Login Account Takeover
Summary
The Alloggio Membership plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.0.2. This is due to the plugin not properly validating a user's identity through the alloggio_membership_init_rest_api_facebook_login and alloggio_membership_init_rest_api_google_login functions. This makes it possible for unauthenticated attackers to log in as any user, including administrators, without knowing a password.
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-288 - Authentication Bypass Using an Alternate Path or Channel
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Edge-Themes | Alloggio Membership |
Affected:
0 , ≤ 1.1
(semver)
|
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-1638",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-03-03T20:55:30.719861Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-03-03T20:56:57.878Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Alloggio Membership",
"vendor": "Edge-Themes",
"versions": [
{
"lessThanOrEqual": "1.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Tonn"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Alloggio Membership plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.0.2. This is due to the plugin not properly validating a user\u0027s identity through the alloggio_membership_init_rest_api_facebook_login and alloggio_membership_init_rest_api_google_login functions. This makes it possible for unauthenticated attackers to log in as any user, including administrators, without knowing a password."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-288",
"description": "CWE-288 Authentication Bypass Using an Alternate Path or Channel",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-08T16:56:33.805Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/60405e54-e869-4623-892c-0821014f887b?source=cve"
},
{
"url": "https://themeforest.net/item/alloggio-hotel-booking-theme/26775539"
}
],
"timeline": [
{
"lang": "en",
"time": "2025-02-28T00:00:00.000Z",
"value": "Disclosed"
}
],
"title": "Alloggio Membership \u003c= 1.1 - Authentication Bypass via Social Login Account Takeover"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2025-1638",
"datePublished": "2025-03-01T07:24:04.067Z",
"dateReserved": "2025-02-24T16:46:22.040Z",
"dateUpdated": "2026-04-08T16:56:33.805Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-1671 (GCVE-0-2025-1671)
Vulnerability from cvelistv5 – Published: 2025-03-01 07:24 – Updated: 2026-04-08 17:06
VLAI
Title
Academist Membership <= 1.1.6 - Authentication Bypass via Account Takeover
Summary
The Academist Membership plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.1.6. This is due to the academist_membership_check_facebook_user() function not properly verifying a user's identity prior to authenticating them. This makes it possible for unauthenticated attackers to log in as any user, including site administrators.
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-288 - Authentication Bypass Using an Alternate Path or Channel
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Elated-Themes | Academist Membership |
Affected:
0 , ≤ 1.1.6
(semver)
|
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-1671",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-03-03T20:55:27.958074Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-03-03T20:56:52.336Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Academist Membership",
"vendor": "Elated-Themes",
"versions": [
{
"lessThanOrEqual": "1.1.6",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Tonn"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Academist Membership plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.1.6. This is due to the academist_membership_check_facebook_user() function not properly verifying a user\u0027s identity prior to authenticating them. This makes it possible for unauthenticated attackers to log in as any user, including site administrators."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-288",
"description": "CWE-288 Authentication Bypass Using an Alternate Path or Channel",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-08T17:06:54.805Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/911a9550-1f62-4f28-9d8c-00d9769949c9?source=cve"
},
{
"url": "https://themeforest.net/item/academist-a-modern-learning-management-system-and-education-theme/22376830"
}
],
"timeline": [
{
"lang": "en",
"time": "2025-02-28T00:00:00.000Z",
"value": "Disclosed"
}
],
"title": "Academist Membership \u003c= 1.1.6 - Authentication Bypass via Account Takeover"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2025-1671",
"datePublished": "2025-03-01T07:24:04.682Z",
"dateReserved": "2025-02-24T21:51:36.610Z",
"dateUpdated": "2026-04-08T17:06:54.805Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-1717 (GCVE-0-2025-1717)
Vulnerability from cvelistv5 – Published: 2025-02-27 07:23 – Updated: 2026-04-08 17:34
VLAI
Title
Login Me Now <= 1.7.2 - Authentication Bypass
Summary
The Login Me Now plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 1.7.2. This is due to insecure authentication based on an arbitrary transient name in the 'AutoLogin::listen()' function. This makes it possible for unauthenticated attackers to log in an existing user on the site, even an administrator. Note: this vulnerability requires using a transient name and value from another software, so the plugin is not inherently vulnerable on it's own.
Severity
8.1 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-288 - Authentication Bypass Using an Alternate Path or Channel
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| pluginly | Login Me Now – Passwordless, Magic Link, OTP & Social Login for WordPress |
Affected:
0 , ≤ 1.7.2
(semver)
|
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-1717",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-02-27T14:38:18.277150Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-02-27T14:38:26.954Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Login Me Now \u2013 Passwordless, Magic Link, OTP \u0026 Social Login for WordPress",
"vendor": "pluginly",
"versions": [
{
"lessThanOrEqual": "1.7.2",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Istv\u00e1n M\u00e1rton"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Login Me Now plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 1.7.2. This is due to insecure authentication based on an arbitrary transient name in the \u0027AutoLogin::listen()\u0027 function. This makes it possible for unauthenticated attackers to log in an existing user on the site, even an administrator. Note: this vulnerability requires using a transient name and value from another software, so the plugin is not inherently vulnerable on it\u0027s own."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-288",
"description": "CWE-288 Authentication Bypass Using an Alternate Path or Channel",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-08T17:34:46.312Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/fc689622-50d6-47c4-a5f6-0314b1a207c9?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/login-me-now/tags/1.7.2/app/Logins/BrowserTokenLogin/AutoLogin.php#L24"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3247924/login-me-now"
}
],
"timeline": [
{
"lang": "en",
"time": "2025-02-26T00:00:00.000Z",
"value": "Discovered"
},
{
"lang": "en",
"time": "2025-02-26T00:00:00.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2025-02-26T00:00:00.000Z",
"value": "Disclosed"
}
],
"title": "Login Me Now \u003c= 1.7.2 - Authentication Bypass"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2025-1717",
"datePublished": "2025-02-27T07:23:13.273Z",
"dateReserved": "2025-02-26T15:43:02.736Z",
"dateUpdated": "2026-04-08T17:34:46.312Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-1739 (GCVE-0-2025-1739)
Vulnerability from cvelistv5 – Published: 2025-02-27 12:45 – Updated: 2025-02-27 14:24
VLAI
Title
Multiple vulnerabilities in Trivision Camera NC227WF
Summary
An Authentication Bypass vulnerability has been found in Trivision Camera NC227WF v5.8.0 from TrivisionSecurity. This vulnerability allows an attacker to retrieve administrator's credentials in cleartext by sending a request against the server using curl with random credentials to "/en/player/activex_pal.asp" and successfully authenticating the application.
Severity
7.1 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Trivision | Camera NC227WF |
Unaffected:
5.8.0
|
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-1739",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-02-27T14:24:04.352327Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-02-27T14:24:12.502Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Camera NC227WF",
"vendor": "Trivision",
"versions": [
{
"status": "unaffected",
"version": "5.8.0"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Andrea Brosio"
},
{
"lang": "en",
"type": "finder",
"value": "Andris Raugulis"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "An Authentication Bypass vulnerability has been found in Trivision Camera NC227WF v5.8.0 from TrivisionSecurity. This vulnerability allows an attacker to retrieve administrator\u0027s credentials in cleartext by sending a request against the server using curl with random credentials to \"/en/player/activex_pal.asp\" and successfully authenticating the application."
}
],
"value": "An Authentication Bypass vulnerability has been found in Trivision Camera NC227WF v5.8.0 from TrivisionSecurity. This vulnerability allows an attacker to retrieve administrator\u0027s credentials in cleartext by sending a request against the server using curl with random credentials to \"/en/player/activex_pal.asp\" and successfully authenticating the application."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-288",
"description": "CWE-288",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-02-27T12:47:10.616Z",
"orgId": "0cbda920-cd7f-484a-8e76-bf7f4b7f4516",
"shortName": "INCIBE"
},
"references": [
{
"url": "https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-trivision-camera-nc227wf"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "There is no reported solution at this time. \u003cbr\u003e"
}
],
"value": "There is no reported solution at this time."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Multiple vulnerabilities in Trivision Camera NC227WF",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "0cbda920-cd7f-484a-8e76-bf7f4b7f4516",
"assignerShortName": "INCIBE",
"cveId": "CVE-2025-1739",
"datePublished": "2025-02-27T12:45:26.314Z",
"dateReserved": "2025-02-27T08:34:32.796Z",
"dateUpdated": "2025-02-27T14:24:12.502Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-1909 (GCVE-0-2025-1909)
Vulnerability from cvelistv5 – Published: 2025-05-05 19:42 – Updated: 2026-04-08 17:02
VLAI
Title
BuddyBoss Platform Pro <= 2.7.01 - Authentication Bypass via Apple OAuth provider
Summary
The BuddyBoss Platform Pro plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.7.01. This is due to insufficient verification on the user being supplied during the Apple OAuth authenticate request through the plugin. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the email.
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-288 - Authentication Bypass Using an Alternate Path or Channel
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| BuddyBoss | BuddyBoss Platform Pro |
Affected:
0 , ≤ 2.7.01
(semver)
|
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-1909",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-05-05T20:01:10.968335Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-05-05T20:01:47.215Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "BuddyBoss Platform Pro",
"vendor": "BuddyBoss",
"versions": [
{
"lessThanOrEqual": "2.7.01",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Istv\u00e1n M\u00e1rton"
}
],
"descriptions": [
{
"lang": "en",
"value": "The BuddyBoss Platform Pro plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.7.01. This is due to insufficient verification on the user being supplied during the Apple OAuth authenticate request through the plugin. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the email."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-288",
"description": "CWE-288 Authentication Bypass Using an Alternate Path or Channel",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-08T17:02:46.314Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/7cce9b8b-0589-4b09-b184-a66fc86fcb46?source=cve"
},
{
"url": "https://www.buddyboss.com/resources/buddyboss-platform-pro-releases/"
},
{
"url": "https://www.buddyboss.com/resources/buddyboss-platform-pro-releases/2-7-10/"
}
],
"timeline": [
{
"lang": "en",
"time": "2025-03-03T00:00:00.000Z",
"value": "Discovered"
},
{
"lang": "en",
"time": "2025-03-03T00:00:00.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2025-05-05T00:00:00.000Z",
"value": "Disclosed"
}
],
"title": "BuddyBoss Platform Pro \u003c= 2.7.01 - Authentication Bypass via Apple OAuth provider"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2025-1909",
"datePublished": "2025-05-05T19:42:25.763Z",
"dateReserved": "2025-03-03T20:30:59.037Z",
"dateUpdated": "2026-04-08T17:02:46.314Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-2080 (GCVE-0-2025-2080)
Vulnerability from cvelistv5 – Published: 2025-03-13 16:57 – Updated: 2025-03-13 18:46
VLAI
Summary
Optigo Networks Visual BACnet Capture Tool and Optigo Visual Networks Capture Tool version 3.1.2rc11 contain an exposed web management service that could allow an attacker to bypass authentication measures and gain controls over utilities within the products.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-288 - Authentication Bypass Using an Alternate Path or Channel
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.cisa.gov/news-events/ics-advisories/i… | government-resource |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Optigo Networks | Visual BACnet Capture Tool |
Affected:
3.1.2rc11
|
|
| Optigo Networks | Optigo Visual Networks Capture Tool |
Affected:
3.1.2rc11
|
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-2080",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-03-13T18:46:34.960491Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-03-13T18:46:42.625Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Visual BACnet Capture Tool",
"vendor": "Optigo Networks",
"versions": [
{
"status": "affected",
"version": "3.1.2rc11"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Optigo Visual Networks Capture Tool",
"vendor": "Optigo Networks",
"versions": [
{
"status": "affected",
"version": "3.1.2rc11"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Tomer Goldschmidt of Claroty Team82"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003e\u003c/p\u003e\n\n\u003cp\u003eOptigo Networks Visual BACnet Capture Tool and Optigo Visual Networks Capture Tool version 3.1.2rc11 contain an exposed web management service that could allow an attacker to bypass authentication measures and gain controls over utilities within the products.\u003c/p\u003e"
}
],
"value": "Optigo Networks Visual BACnet Capture Tool and Optigo Visual Networks Capture Tool version 3.1.2rc11 contain an exposed web management service that could allow an attacker to bypass authentication measures and gain controls over utilities within the products."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-288",
"description": "CWE-288 Authentication Bypass Using an Alternate Path or Channel",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-03-13T16:57:30.147Z",
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"shortName": "icscert"
},
"references": [
{
"tags": [
"government-resource"
],
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-25-070-02"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eOptigo Networks recommends users to upgrade to the following:\u003c/p\u003e\u003cul\u003e\u003cli\u003eVisual BACnet Capture Tool: \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://optigo.zendesk.com/hc/en-us/sections/360011386412-Capture-Tool-Software-Visual-BACnet\"\u003eVersion v3.1.3rc8\u003c/a\u003e\u003c/li\u003e\u003cli\u003eOptigo Visual Networks Capture Tool: \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://optigo.zendesk.com/hc/en-us/sections/20125604316813-Capture-Tool-Software-Optigo-Visual-Networks\"\u003eVersion v3.1.3rc8\u003c/a\u003e\u003c/li\u003e\u003c/ul\u003e\n\n\u003cbr\u003e"
}
],
"value": "Optigo Networks recommends users to upgrade to the following:\n\n * Visual BACnet Capture Tool: Version v3.1.3rc8 https://optigo.zendesk.com/hc/en-us/sections/360011386412-Capture-Tool-Software-Visual-BACnet \n * Optigo Visual Networks Capture Tool: Version v3.1.3rc8 https://optigo.zendesk.com/hc/en-us/sections/20125604316813-Capture-Tool-Software-Optigo-Visual-Networks"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"assignerShortName": "icscert",
"cveId": "CVE-2025-2080",
"datePublished": "2025-03-13T16:57:30.147Z",
"dateReserved": "2025-03-06T22:01:47.991Z",
"dateUpdated": "2025-03-13T18:46:42.625Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-21589 (GCVE-0-2025-21589)
Vulnerability from cvelistv5 – Published: 2026-01-27 20:32 – Updated: 2026-01-27 21:28
VLAI
Title
Session Smart Router, Session Smart Conductor, WAN Assurance Router: API Authentication Bypass vulnerability
Summary
An Authentication Bypass Using an
Alternate Path or Channel vulnerability in Juniper Networks Session Smart
Router may allows a network-based attacker to bypass authentication
and take administrative control of the device.
This issue affects Session Smart Router:
* from 5.6.7 before 5.6.17,
* from 6.0 before 6.0.8 (affected from 6.0.8),
* from 6.1 before 6.1.12-lts,
* from 6.2 before 6.2.8-lts,
* from 6.3 before 6.3.3-r2;
This issue affects Session Smart Conductor:
* from 5.6.7 before 5.6.17,
* from 6.0 before 6.0.8 (affected from 6.0.8),
* from 6.1 before 6.1.12-lts,
* from 6.2 before 6.2.8-lts,
* from 6.3 before 6.3.3-r2;
This issue affects WAN Assurance Managed Routers:
* from 5.6.7 before 5.6.17,
* from 6.0 before 6.0.8 (affected from 6.0.8),
* from 6.1 before 6.1.12-lts,
* from 6.2 before 6.2.8-lts,
* from 6.3 before 6.3.3-r2.
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-288 - Authentication Bypass Using an Alternate Path or Channel
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://supportportal.juniper.net/ | vendor-advisory |
| https://support.juniper.net/support/eol/software/ssr/ | related |
| https://kb.juniper.net/JSA94663 | vendor-advisory |
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| Juniper Networks | Session Smart Router |
Affected:
5.6.7 , < 5.6.17
(semver)
Unaffected: 6.0 , < 6.0.8 (semver) Affected: 6.1 , < 6.1.12-lts (semver) Affected: 6.2 , < 6.2.8-lts (semver) Affected: 6.3 , < 6.3.3-r2 (semver) |
|
| Juniper Networks | Session Smart Conductor |
Affected:
5.6.7 , < 5.6.17
(semver)
Unaffected: 6.0 , < 6.0.8 (semver) Affected: 6.1 , < 6.1.12-lts (semver) Affected: 6.2 , < 6.2.8-lts (semver) Affected: 6.3 , < 6.3.3-r2 (semver) |
|
| Juniper Networks | WAN Assurance Managed Router |
Affected:
5.6.7 , < 5.6.17
(semver)
Unaffected: 6.0 , < 6.0.8 (semver) Affected: 6.1 , < 6.1.12-lts (semver) Affected: 6.2 , < 6.2.8-lts (semver) Affected: 6.3 , < 6.3.3-r2 (semver) |
Date Public
2025-02-04 17:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-21589",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-01-27T21:27:50.309259Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-01-27T21:28:02.560Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Session Smart Router",
"vendor": "Juniper Networks",
"versions": [
{
"lessThan": "5.6.17",
"status": "affected",
"version": "5.6.7",
"versionType": "semver"
},
{
"changes": [
{
"at": "6.0.8",
"status": "affected"
}
],
"lessThan": "6.0.8",
"status": "unaffected",
"version": "6.0",
"versionType": "semver"
},
{
"lessThan": "6.1.12-lts",
"status": "affected",
"version": "6.1",
"versionType": "semver"
},
{
"lessThan": "6.2.8-lts",
"status": "affected",
"version": "6.2",
"versionType": "semver"
},
{
"lessThan": "6.3.3-r2",
"status": "affected",
"version": "6.3",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Session Smart Conductor",
"vendor": "Juniper Networks",
"versions": [
{
"lessThan": "5.6.17",
"status": "affected",
"version": "5.6.7",
"versionType": "semver"
},
{
"changes": [
{
"at": "6.0.8",
"status": "affected"
}
],
"lessThan": "6.0.8",
"status": "unaffected",
"version": "6.0",
"versionType": "semver"
},
{
"lessThan": "6.1.12-lts",
"status": "affected",
"version": "6.1",
"versionType": "semver"
},
{
"lessThan": "6.2.8-lts",
"status": "affected",
"version": "6.2",
"versionType": "semver"
},
{
"lessThan": "6.3.3-r2",
"status": "affected",
"version": "6.3",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WAN Assurance Managed Router",
"vendor": "Juniper Networks",
"versions": [
{
"lessThan": "5.6.17",
"status": "affected",
"version": "5.6.7",
"versionType": "semver"
},
{
"changes": [
{
"at": "6.0.8",
"status": "affected"
}
],
"lessThan": "6.0.8",
"status": "unaffected",
"version": "6.0",
"versionType": "semver"
},
{
"lessThan": "6.1.12-lts",
"status": "affected",
"version": "6.1",
"versionType": "semver"
},
{
"lessThan": "6.2.8-lts",
"status": "affected",
"version": "6.2",
"versionType": "semver"
},
{
"lessThan": "6.3.3-r2",
"status": "affected",
"version": "6.3",
"versionType": "semver"
}
]
}
],
"datePublic": "2025-02-04T17:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAn Authentication Bypass Using an\nAlternate Path or Channel vulnerability in Juniper Networks Session Smart\nRouter may allows a network-based attacker to bypass authentication\nand take administrative control of the device.\u003c/p\u003e\u003cp\u003eThis issue affects Session Smart Router:\u0026nbsp;\u003c/p\u003e\u003cp\u003e\u003c/p\u003e\u003cul\u003e\u003cli\u003efrom 5.6.7 before 5.6.17,\u0026nbsp;\u003c/li\u003e\u003cli\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003efrom 6.0 before 6.0.8 (affected from 6.0.8),\u003c/span\u003e\u003cbr\u003e\u003c/li\u003e\u003cli\u003efrom 6.1 before 6.1.12-lts,\u0026nbsp;\u003c/li\u003e\u003cli\u003efrom 6.2 before 6.2.8-lts,\u0026nbsp;\u003c/li\u003e\u003cli\u003efrom 6.3 before 6.3.3-r2;\u0026nbsp;\u003c/li\u003e\u003c/ul\u003e\u003cp\u003e\u003c/p\u003e\u003cp\u003eThis issue affects Session Smart Conductor:\u0026nbsp;\u003c/p\u003e\u003cp\u003e\u003c/p\u003e\u003cul\u003e\u003cli\u003efrom 5.6.7 before 5.6.17,\u0026nbsp;\u003c/li\u003e\u003cli\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003efrom 6.0 before 6.0.8 (affected from 6.0.8),\u003c/span\u003e\u003cbr\u003e\u003c/li\u003e\u003cli\u003efrom 6.1 before 6.1.12-lts,\u0026nbsp;\u003c/li\u003e\u003cli\u003efrom 6.2 before 6.2.8-lts,\u0026nbsp;\u003c/li\u003e\u003cli\u003efrom 6.3 before 6.3.3-r2;\u0026nbsp;\u003c/li\u003e\u003c/ul\u003e\u003cp\u003e\u003c/p\u003e\u003cp\u003eThis issue affects WAN Assurance Managed Routers:\u0026nbsp;\u003c/p\u003e\u003cp\u003e\u003c/p\u003e\u003cul\u003e\u003cli\u003efrom 5.6.7 before 5.6.17,\u0026nbsp;\u003c/li\u003e\u003cli\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003efrom 6.0 before 6.0.8 (affected from 6.0.8),\u003c/span\u003e\u003cbr\u003e\u003c/li\u003e\u003cli\u003efrom 6.1 before 6.1.12-lts,\u0026nbsp;\u003c/li\u003e\u003cli\u003efrom 6.2 before 6.2.8-lts,\u0026nbsp;\u003c/li\u003e\u003cli\u003efrom 6.3 before 6.3.3-r2.\u003c/li\u003e\u003c/ul\u003e\u003cp\u003e\u003c/p\u003e"
}
],
"value": "An Authentication Bypass Using an\nAlternate Path or Channel vulnerability in Juniper Networks Session Smart\nRouter may allows a network-based attacker to bypass authentication\nand take administrative control of the device.\n\nThis issue affects Session Smart Router:\u00a0\n\n\n\n * from 5.6.7 before 5.6.17,\u00a0\n * from 6.0 before 6.0.8 (affected from 6.0.8),\n\n * from 6.1 before 6.1.12-lts,\u00a0\n * from 6.2 before 6.2.8-lts,\u00a0\n * from 6.3 before 6.3.3-r2;\u00a0\n\n\n\n\nThis issue affects Session Smart Conductor:\u00a0\n\n\n\n * from 5.6.7 before 5.6.17,\u00a0\n * from 6.0 before 6.0.8 (affected from 6.0.8),\n\n * from 6.1 before 6.1.12-lts,\u00a0\n * from 6.2 before 6.2.8-lts,\u00a0\n * from 6.3 before 6.3.3-r2;\u00a0\n\n\n\n\nThis issue affects WAN Assurance Managed Routers:\u00a0\n\n\n\n * from 5.6.7 before 5.6.17,\u00a0\n * from 6.0 before 6.0.8 (affected from 6.0.8),\n\n * from 6.1 before 6.1.12-lts,\u00a0\n * from 6.2 before 6.2.8-lts,\u00a0\n * from 6.3 before 6.3.3-r2."
}
],
"exploits": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Juniper SIRT is not aware of any malicious exploitation of this vulnerability."
}
],
"value": "Juniper SIRT is not aware of any malicious exploitation of this vulnerability."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-288",
"description": "CWE-288 Authentication Bypass Using an Alternate Path or Channel",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-01-27T20:32:13.334Z",
"orgId": "8cbe9d5a-a066-4c94-8978-4b15efeae968",
"shortName": "juniper"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://supportportal.juniper.net/"
},
{
"tags": [
"related"
],
"url": "https://support.juniper.net/support/eol/software/ssr/"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://kb.juniper.net/JSA94663"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe following software releases have\nbeen updated to resolve this issue:\u003c/p\u003e\n\n\u003cp\u003e\u003cbr\u003e\n\u003cb\u003eSession Smart Router:\u003c/b\u003e\u0026nbsp;SSR-5.6.17, SSR-6.1.12-lts, SSR-6.2.8-lts,\nSSR-6.3.3-r2 and subsequent releases. \u003c/p\u003e\n\n\u003cp\u003e\u003cbr\u003e\nIt is suggested to upgrade all affected systems to one of these versions of\nsoftware. In a Conductor-managed deployment, it is sufficient to upgrade only the\nConductor nodes and the fix will be applied automatically to all connected\nrouters. As practical, the routers should still be upgraded to a fixed version\nhowever they will not be vulnerable once they connect to an upgraded Conductor.\u0026nbsp;Router patching can be confirmed once the router reaches the \u201crunning\" (on 6.2 and earlier) or \u201csynchronized\u201d (on 6.3+) state on the Conductor\".\u003cbr\u003e\n\u0026nbsp;\u003c/p\u003e\n\n\u003cp\u003eThis vulnerability has been patched\nautomatically on devices that operate with WAN Assurance (where configuration is also managed) connected\nto the Mist Cloud. As practical, the routers should still be upgraded to a version\ncontaining the fix.\u003cbr\u003e\n\u003cbr\u003e\nIt is important to note that when the fix is applied automatically on routers managed\nby a Conductor or on WAN assurance, it will have no impact on data-plane\nfunctions of the router. The application of the fix is non-disruptive to\nproduction traffic. There may be a momentary downtime (less than 30 seconds) to\nthe web-based management and APIs.\u0026nbsp;\u003c/p\u003e"
}
],
"value": "The following software releases have\nbeen updated to resolve this issue:\n\n\n\n\n\nSession Smart Router:\u00a0SSR-5.6.17, SSR-6.1.12-lts, SSR-6.2.8-lts,\nSSR-6.3.3-r2 and subsequent releases. \n\n\n\n\n\nIt is suggested to upgrade all affected systems to one of these versions of\nsoftware. In a Conductor-managed deployment, it is sufficient to upgrade only the\nConductor nodes and the fix will be applied automatically to all connected\nrouters. As practical, the routers should still be upgraded to a fixed version\nhowever they will not be vulnerable once they connect to an upgraded Conductor.\u00a0Router patching can be confirmed once the router reaches the \u201crunning\" (on 6.2 and earlier) or \u201csynchronized\u201d (on 6.3+) state on the Conductor\".\n\n\u00a0\n\n\n\nThis vulnerability has been patched\nautomatically on devices that operate with WAN Assurance (where configuration is also managed) connected\nto the Mist Cloud. As practical, the routers should still be upgraded to a version\ncontaining the fix.\n\n\n\nIt is important to note that when the fix is applied automatically on routers managed\nby a Conductor or on WAN assurance, it will have no impact on data-plane\nfunctions of the router. The application of the fix is non-disruptive to\nproduction traffic. There may be a momentary downtime (less than 30 seconds) to\nthe web-based management and APIs."
}
],
"source": {
"advisory": "JSA94663",
"defect": [
"I95-59677"
],
"discovery": "INTERNAL"
},
"title": "Session Smart Router, Session Smart Conductor, WAN Assurance Router: API Authentication Bypass vulnerability",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "There are no known workarounds for this issue."
}
],
"value": "There are no known workarounds for this issue."
}
],
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "8cbe9d5a-a066-4c94-8978-4b15efeae968",
"assignerShortName": "juniper",
"cveId": "CVE-2025-21589",
"datePublished": "2026-01-27T20:32:13.334Z",
"dateReserved": "2024-12-26T14:47:11.667Z",
"dateUpdated": "2026-01-27T21:28:02.560Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-22230 (GCVE-0-2025-22230)
Vulnerability from cvelistv5 – Published: 2025-03-25 14:06 – Updated: 2025-03-25 14:19
VLAI
Title
Authentication bypass vulnerability
Summary
VMware Tools for Windows contains an authentication bypass vulnerability due to improper access control. A malicious actor with non-administrative privileges on a guest VM may gain ability to perform certain high privilege operations within that VM.
Severity
7.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| n/a | VMware Tools |
Affected:
12.x.x, 11.x.x , < 12.5.1
(custom)
|
Date Public
2025-03-25 12:41
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-22230",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-03-25T14:19:23.818666Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-03-25T14:19:35.488Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "VMware Tools",
"vendor": "n/a",
"versions": [
{
"lessThan": "12.5.1",
"status": "affected",
"version": "12.x.x, 11.x.x",
"versionType": "custom"
}
]
}
],
"datePublic": "2025-03-25T12:41:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eVMware Tools for Windows contains an authentication bypass vulnerability \u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003edue to i\u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003emproper access control.\u0026nbsp;\u003c/span\u003eA malicious actor with non-administrative privileges on a guest VM may gain ability to perform certain high privilege operations within that VM.\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\u003cbr\u003e\u003cbr\u003e\u003c/span\u003e\u003cbr\u003e"
}
],
"value": "VMware Tools for Windows contains an authentication bypass vulnerability due to improper access control.\u00a0A malicious actor with non-administrative privileges on a guest VM may gain ability to perform certain high privilege operations within that VM."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-288",
"description": "CWE-288",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-03-25T14:06:35.413Z",
"orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
"shortName": "vmware"
},
"references": [
{
"url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25518"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Authentication bypass vulnerability",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
"assignerShortName": "vmware",
"cveId": "CVE-2025-22230",
"datePublished": "2025-03-25T14:06:35.413Z",
"dateReserved": "2025-01-02T04:29:59.191Z",
"dateUpdated": "2025-03-25T14:19:35.488Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-22277 (GCVE-0-2025-22277)
Vulnerability from cvelistv5 – Published: 2025-04-01 05:32 – Updated: 2026-04-28 16:10
VLAI
Title
WordPress Vitepos plugin <= 3.1.4 - Broken Authentication vulnerability
Summary
Authentication Bypass Using an Alternate Path or Channel vulnerability in appsbd Vitepos vitepos-lite allows Authentication Abuse.This issue affects Vitepos: from n/a through <= 3.1.4.
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-288 - Authentication Bypass Using an Alternate Path or Channel
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://patchstack.com/database/Wordpress/Plugin/… | vdb-entry |
Date Public
2026-04-01 16:31
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-22277",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-04-01T13:32:52.863514Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-04-01T13:36:09.554Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://wordpress.org/plugins",
"defaultStatus": "unaffected",
"packageName": "vitepos-lite",
"product": "Vitepos",
"vendor": "appsbd",
"versions": [
{
"changes": [
{
"at": "3.1.5",
"status": "unaffected"
}
],
"lessThanOrEqual": "3.1.4",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Phat RiO | Patchstack Bug Bounty Program"
}
],
"datePublic": "2026-04-01T16:31:17.632Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Authentication Bypass Using an Alternate Path or Channel vulnerability in appsbd Vitepos vitepos-lite allows Authentication Abuse.\u003cp\u003eThis issue affects Vitepos: from n/a through \u003c= 3.1.4.\u003c/p\u003e"
}
],
"value": "Authentication Bypass Using an Alternate Path or Channel vulnerability in appsbd Vitepos vitepos-lite allows Authentication Abuse.This issue affects Vitepos: from n/a through \u003c= 3.1.4."
}
],
"impacts": [
{
"capecId": "CAPEC-114",
"descriptions": [
{
"lang": "en",
"value": "Authentication Abuse"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-288",
"description": "Authentication Bypass Using an Alternate Path or Channel",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-28T16:10:57.813Z",
"orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"shortName": "Patchstack"
},
"references": [
{
"tags": [
"vdb-entry"
],
"url": "https://patchstack.com/database/Wordpress/Plugin/vitepos-lite/vulnerability/wordpress-vitepos-plugin-3-1-4-broken-authentication-vulnerability?_s_id=cve"
}
],
"title": "WordPress Vitepos plugin \u003c= 3.1.4 - Broken Authentication vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"assignerShortName": "Patchstack",
"cveId": "CVE-2025-22277",
"datePublished": "2025-04-01T05:32:24.249Z",
"dateReserved": "2025-01-03T13:15:43.299Z",
"dateUpdated": "2026-04-28T16:10:57.813Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-22462 (GCVE-0-2025-22462)
Vulnerability from cvelistv5 – Published: 2025-05-13 15:10 – Updated: 2025-05-13 19:39
VLAI
Summary
An authentication bypass in Ivanti Neurons for ITSM (on-prem only) before 2023.4, 2024.2 and 2024.3 with the May 2025 Security Patch allows a remote unauthenticated attacker to gain administrative access to the system.
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Ivanti | Neurons for ITSM (on-prem) |
Unaffected:
2023.4 w/ May 2025 Security Patch
(custom)
Unaffected: 2024.2 w/ May 2025 Security Patch (custom) Unaffected: 2024.3 w/ May 2025 Security Patch (custom) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-22462",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-05-13T19:39:34.075517Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-05-13T19:39:47.647Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "affected",
"product": "Neurons for ITSM (on-prem)",
"vendor": "Ivanti",
"versions": [
{
"status": "unaffected",
"version": "2023.4 w/ May 2025 Security Patch",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "2024.2 w/ May 2025 Security Patch",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "2024.3 w/ May 2025 Security Patch",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eAn authentication bypass in Ivanti Neurons for ITSM (on-prem only) before 2023.4, 2024.2 and 2024.3 with the May 2025 Security Patch allows a remote unauthenticated attacker to gain administrative access to the system.\u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\u0026nbsp;\u003c/span\u003e"
}
],
"value": "An authentication bypass in Ivanti Neurons for ITSM (on-prem only) before 2023.4, 2024.2 and 2024.3 with the May 2025 Security Patch allows a remote unauthenticated attacker to gain administrative access to the system."
}
],
"impacts": [
{
"capecId": "CAPEC-115",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-115 Authentication Bypass"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-288",
"description": "CWE-288",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-05-13T15:10:17.923Z",
"orgId": "3c1d8aa1-5a33-4ea4-8992-aadd6440af75",
"shortName": "ivanti"
},
"references": [
{
"url": "https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Neurons-for-ITSM-on-premises-only-CVE-2025-22462"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "3c1d8aa1-5a33-4ea4-8992-aadd6440af75",
"assignerShortName": "ivanti",
"cveId": "CVE-2025-22462",
"datePublished": "2025-05-13T15:10:17.923Z",
"dateReserved": "2025-01-07T02:19:22.797Z",
"dateUpdated": "2025-05-13T19:39:47.647Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
Mitigation
Phase: Architecture and Design
Description:
- Funnel all access through a single choke point to simplify how users can access a resource. For every access, perform a check to determine if the user has permissions to access the resource.
CAPEC-127: Directory Indexing
An adversary crafts a request to a target that results in the target listing/indexing the content of a directory as output. One common method of triggering directory contents as output is to construct a request containing a path that terminates in a directory name rather than a file name since many applications are configured to provide a list of the directory's contents when such a request is received. An adversary can use this to explore the directory tree on a target as well as learn the names of files. This can often end up revealing test files, backup files, temporary files, hidden files, configuration files, user accounts, script contents, as well as naming conventions, all of which can be used by an attacker to mount additional attacks.
CAPEC-665: Exploitation of Thunderbolt Protection Flaws
An adversary leverages a firmware weakness within the Thunderbolt protocol, on a computing device to manipulate Thunderbolt controller firmware in order to exploit vulnerabilities in the implementation of authorization and verification schemes within Thunderbolt protection mechanisms. Upon gaining physical access to a target device, the adversary conducts high-level firmware manipulation of the victim Thunderbolt controller SPI (Serial Peripheral Interface) flash, through the use of a SPI Programing device and an external Thunderbolt device, typically as the target device is booting up. If successful, this allows the adversary to modify memory, subvert authentication mechanisms, spoof identities and content, and extract data and memory from the target device. Currently 7 major vulnerabilities exist within Thunderbolt protocol with 9 attack vectors as noted in the Execution Flow.