CVE-2025-30235

LowCVSS 3.5/10Last modified Jun 17, 2026

Description

Shearwater SecurEnvoy SecurAccess Enrol before 9.4.515 is intended to disable accounts that have had more than 10 failed authentication attempts, but instead allows hundreds of failed authentication attempts, because concurrent attempts are mishandled.

Metrics

CVSS 3.1 3.5/10CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N

Weakness enumeration

CWE-362

Affected software

No affected versions have been published.

Timeline

Published: Mar 19, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-302368.6Shearwater SecurEnvoy SecurAccess Enrol before 9.4.515 allows authentication through only a six-digit TOTP code (skipping a password check) CVE-2025-302378.7The affected TP-Link Aginet devices contain a flaw in the web management interface where authentication checks are not consistently enforced CVE-2025-302388.6In affected TP-Link Aginet devices, insufficient authorization validation allows authenticated low-privileged users to execute higher-privil CVE-2025-302398.5In affected TP-Link Aginet devices, use of hardcoded cryptographic keys embedded in the firmware to protect sensitive configuration data may CVE-2025-302405.1The affected TP-Link Aginet devices do not properly validate symbolic links created on external USB storage devices. By placing a crafted sy CVE-2025-302418.6Certain web interface components in affected TP-Link Aginet devices do not validate and sanitize user-supplied input properly before passing CVE-2025-302479.3An OS command injection vulnerability in user interface in Western Digital My Cloud firmware prior to 5.31.108 on NAS platforms allows remot CVE-2025-302488.9DLL hijacking in the WD Discovery Installer in Western Digital WD Discovery 5.2.730 on Windows allows a local attacker to execute arbitrary CVE-2025-30257.3Elevation of Privileges in the cleaning feature of Gen Digital CCleaner version 6.33.11465 on Windows allows a local user to gain SYSTEM pri CVE-2025-302545.3An unauthenticated attacker can obtain a serial number of a smart meter(s) using its owner's username.CVE-2025-302558.2Out-of-bounds write for some Intel(R) PROSet/Wireless WiFi Software for Windows before version 23.160 within Ring 2: Device Drivers may allo CVE-2025-302567.5A denial of service vulnerability exists in the HTTP Header Parsing functionality of Tenda AC6 V5.0 V02.03.01.110. A specially crafted serie