CVE-2025-54336

Published: Aug 19, 2025Modified: Jun 17, 2026Deferred

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

In Plesk Obsidian 18.0.70, _isAdminPasswordValid uses an == comparison. Thus, if the correct password is "0e" followed by any digit string, then an attacker can login with any other string that evaluates to 0.0 (such as the 0e0 string). This occurs in admin/plib/LoginManager.php.

Related CWEs

CWE-697

Incorrect Comparison

The product compares two entities in a security-relevant context, but the comparison is incorrect, which may lead to resultant weaknesses.

References (3)

https://blog.aziz.tn/2025/08/cve-2025-54336.html/

Source: cve@mitre.org

https://support.plesk.com/hc/en-us/articles/33785727869847-Vulnerability-CVE-2025-54336

Source: cve@mitre.org

https://www.plesk.com/blog/plesk-news-announcements/introducing-plesk-obsidian-18-0-70-anniversary-edition/

Source: cve@mitre.org

Timeline

No history available yet.