CVE-2025-54765

Description

An API endpoint that should be limited to web application administrators is hidden from, but accessible by, lower-level read only web application users. The endpoint can be used to import the appliance configuration, allowing an attacker to control the configuration of the appliance, to include granting themselves administrative level permissions.

PUBLISHED Reserved 2025-07-28 | Published 2025-07-28 | Updated 2025-11-03 | Assigner KoreLogic

Problem types

CWE-648: Incorrect Use of Privileged APIs

Product status

Credits

This vulnerability was discovered by Jim Becher of KoreLogic, Inc. finder

References

seclists.org/fulldisclosure/2025/Jul/16

korelogic.com/Resources/Advisories/KL-001-2025-013.txt third-party-advisory

xormon.com/note190.php release-notes

cve.org (CVE-2025-54765)

nvd.nist.gov (CVE-2025-54765)

Download JSON