CVE-2025-49195

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

The FTP server’s login mechanism does not restrict authentication attempts, allowing an attacker to brute-force user passwords and potentially compromising the FTP server.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-307

Affected software

No affected versions have been published.

Timeline

Published: Jun 12, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-491969.1A service supports the use of a deprecated and unsafe TLS version. This could be exploited to expose sensitive information, modify data in u CVE-2025-491977.5The application uses a weak password hash function, allowing an attacker to crack the weak password hash to gain access to an FTP user accou CVE-2025-491987.5The Media Server’s authorization tokens have a poor quality of randomness. An attacker may be able to guess the token of an active user by c CVE-2025-491999.8The backup ZIPs are not signed by the application, leading to the possibility that an attacker can download a backup ZIP, modify and re-uplo CVE-2025-492007.5The created backup files are unencrypted, making the application vulnerable for gathering sensitive information by downloading and decompres CVE-2025-492019.8A weak authentication vulnerability in Fortinet FortiPAM 1.5.0, FortiPAM 1.4.0 through 1.4.2, FortiPAM 1.3 all versions, FortiPAM 1.2 all ve CVE-2025-492117.8A SQL injection vulnerability in the Trend Micro Endpoint Encryption PolicyServer could allow an attacker to escalate privileges on affected CVE-2025-492129.8An insecure deserialization operation in the Trend Micro Endpoint Encryption PolicyServer could lead to a pre-authentication remote code exe CVE-2025-492139.8An insecure deserialization operation in the Trend Micro Endpoint Encryption PolicyServer could lead to a pre-authentication remote code exe CVE-2025-492148.8An insecure deserialization operation in the Trend Micro Endpoint Encryption PolicyServer could lead to a post-authentication remote code ex CVE-2025-492158.8A post-auth SQL injection vulnerability in the Trend Micro Endpoint Encryption PolicyServer could allow an attacker to escalate privileges o CVE-2025-492169.8An authentication bypass vulnerability in the Trend Micro Endpoint Encryption PolicyServer could allow an attacker to access key methods as