CVE-2025-4558

Published: May 12, 2025Modified: Jun 17, 2026Deferred

9.3

Vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XShow less

Source: twcert@cert.org.tw (Secondary)

Description

The GPM from WormHole Tech has an Unverified Password Change vulnerability, allowing unauthenticated remote attackers to change any user's password and use the modified password to log into the system.

Related CWEs

CWE-620

Unverified Password Change

When setting a new password for a user, the product does not require knowledge of the original password, or using another form of authentication.

References (2)

https://www.twcert.org.tw/en/cp-139-10115-f5f14-2.html

Source: twcert@cert.org.tw

https://www.twcert.org.tw/tw/cp-132-10114-10b4b-1.html

Source: twcert@cert.org.tw

Timeline

No history available yet.