CVE-2025-25268

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

An unauthenticated adjacent attacker can modify configuration by sending specific requests to an API-endpoint resulting in read and write access due to missing authentication.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-306

Affected software

No affected versions have been published.

Timeline

Published: Jul 8, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-252698.4An unauthenticated local attacker can inject a command that is subsequently executed as root, leading to a privilege escalation.CVE-2025-25274.3Mattermost versions 10.5.x <= 10.5.2, 9.11.x <= 9.11.11 failed to properly verify a user's permissions when accessing groups, which allows a CVE-2025-252709.8An unauthenticated remote attacker can alter the device configuration in a way to get remote code execution as root with specific configurat CVE-2025-252718.8An unauthenticated adjacent attacker is able to configure a new OCPP backend, due to insecure defaults for the configuration interface.CVE-2025-252737.8Insufficient control flow management in the Linux kernel-mode driver for some Intel(R) 700 Series Ethernet before version 2.28.5 may allow a CVE-2025-252748.8Mattermost versions 10.4.x <= 10.4.2, 10.3.x <= 10.3.3, 9.11.x <= 9.11.8 fail to restrict command execution in archived channels, which allo CVE-2025-252766.5An unauthenticated attacker can hijack other users' devices and potentially control them.CVE-2025-252777.0in OpenHarmony v5.1.0 and prior versions allow a local attacker arbitrary code execution in pre-installed apps through using incompatible ty CVE-2025-252787.0in OpenHarmony v5.0.3 and prior versions allow a local attacker arbitrary code execution in tcb through race condition.CVE-2025-252797.5Mattermost versions 10.4.x <= 10.4.1, 9.11.x <= 9.11.7, 10.3.x <= 10.3.2, 10.2.x <= 10.2.2 fail to properly validate board blocks when impor CVE-2025-25283.6Improper authorization in application password policy in Devolutions Remote Desktop Manager on Windows allows an authenticated user to use CVE-2025-252805.3Buffer overflow vulnerability exists in FutureNet AS series (Industrial Routers) and FA series (Protocol Conversion Machine) provided by Cen