CVE-2025-30236

Published: Mar 19, 2025Modified: Jun 17, 2026Deferred

8.6

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N

Exploitability: 3.9 / Impact: 4.0

Source: MITRE (Secondary)

Description

Shearwater SecurEnvoy SecurAccess Enrol before 9.4.515 allows authentication through only a six-digit TOTP code (skipping a password check) if an HTTP POST request contains a SESSION parameter.

Related CWEs

CWE-472

External Control of Assumed-Immutable Web Parameter

The web application does not sufficiently verify inputs that are assumed to be immutable but are actually externally controllable, such as hidden form fields.

References (2)

https://reserge.org/probabilistically-breaking-securenvoy-totp/

Source: cve@mitre.org

https://securenvoy.com/wp-content/uploads/2025/03/Release-Notes-9.4.515.pdf

Source: cve@mitre.org

Timeline

No history available yet.