CVE-2025-44005

CriticalCVSS 10.0/10Last modified Jun 17, 2026

Description

An attacker can bypass authorization checks and force a Step CA ACME or SCEP provisioner to create certificates without completing certain protocol authorization checks.

Metrics

CVSS 3.1 10.0/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

Weakness enumeration

CWE-287

Affected software

No affected versions have been published.

Timeline

Published
Dec 17, 2025
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-440066.5An allocation of resources without limits or throttling vulnerability has been reported to affect Qsync Central. If a remote attacker gains CVE-2025-440076.5An allocation of resources without limits or throttling vulnerability has been reported to affect Qsync Central. If a remote attacker gains CVE-2025-440086.5A NULL pointer dereference vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can thenCVE-2025-440096.5A NULL pointer dereference vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can thenCVE-2025-440106.5A NULL pointer dereference vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can thenCVE-2025-440116.5A NULL pointer dereference vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can thenCVE-2025-440126.5An allocation of resources without limits or throttling vulnerability has been reported to affect Qsync Central. If a remote attacker gains CVE-2025-440136.5A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains a usCVE-2025-440148.8An out-of-bounds write vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then expCVE-2025-440158.4A command injection vulnerability has been reported to affect HybridDesk Station. If an attacker gains local network access, they can then eCVE-2025-440168.8A vulnerability in TeamViewer DEX Client (former 1E client) - Content Distribution Service (NomadBranch.exe) prior version 25.11 for WindowsCVE-2025-440175.1"Gunosy" App contains a vulnerability where sensitive information may be included in the application's outbound communication. If a user acc
CVE-2025-44005: Critical severity, CVSS 10.0 | Vulnix