CVE-2025-53704

HighCVSS 7.5/10Last modified Oct 18, 2026

Description

The password reset mechanism for the Pivot client application is weak, and it may allow an attacker to take over the account.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-640

Affected software

VendorProductVersions
MAXHUBPivot client application< 1.36.2

References

Timeline

Published
Dec 4, 2025
Last modified
Oct 18, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-537057.8In Ashlar-Vellum Cobalt, Xenon, Argon, Lithium, and Cobalt Share versions prior to 12.6.1204.204, the affected applications lack proper valiCVE-2025-537076.1A reflected cross-site scripting (xss) vulnerability exists in the modifyTranscript functionality of MedDream PACS Premium 7.3.6.870. A specCVE-2025-537095.4Secure-upload is a data submission service that validates single-use tokens when accepting submissions to channels. The service only installCVE-2025-53719.8A vulnerability, which was classified as critical, has been found in SourceCodester Health Center Patient Record Management System 1.0. AffeCVE-2025-537107.5Due to a product misconfiguration in certain deployment types, it was possible from different pods in the same namespace to communicate withCVE-2025-537117.5A vulnerability has been found in TP-Link TL-WR841N v11, TL-WR842ND v2 and TL-WR494N v3. The vulnerability exists in the /userRpm/WlanNetworCVE-2025-537127.5A vulnerability has been found in TP-Link TL-WR841N V11. The vulnerability exists in the /userRpm/WlanNetworkRpm_AP.htm file due to missing CVE-2025-537137.5A vulnerability has been found in TP-Link TL-WR841N V11. The vulnerability exists in the /userRpm/WlanNetworkRpm_APC.htm file due to missingCVE-2025-537147.5A vulnerability has been found in TP-Link TL-WR841N V11. The vulnerability exists in the /userRpm/WzdWlanSiteSurveyRpm_AP.htm file due to miCVE-2025-537157.5A vulnerability has been found in TP-Link TL-WR841N V11. The vulnerability exists in the /userRpm/Wan6to4TunnelCfgRpm.htm file due to missinCVE-2025-537166.5Null pointer dereference in Windows Local Security Authority Subsystem Service (LSASS) allows an authorized attacker to deny service over a CVE-2025-537177.0Reliance on untrusted inputs in a security decision in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to
CVE-2025-53704: High severity, CVSS 7.5 | Vulnix