CVE-2025-15398

Katalog CVE

CVSS 8.1 · High EPSS 0,56%

Kerentanan Weak Password Recovery Mechanism for Forgotten Password pada uatech badaso. Skor CVSS 3.1 8.1 (High) menurut NVD.

Deskripsi (NVD)

A security vulnerability has been detected in Uasoft badaso up to 2.9.7. Affected is the function forgetPassword of the file src/Controllers/BadasoAuthController.php of the component Token Handler. Such manipulation leads to weak password recovery. The attack can be executed remotely. This attack is characterized by high complexity. The exploitability is told to be difficult. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Rincian

Terbit di NVD

31 Desember 2025

Terakhir diubah

23 September 2026

Status NVD

Analyzed

CVSS 3.1

8.1 (High), sumber NVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-640: Weak Password Recovery Mechanism for Forgotten Password

EPSS (30 hari)

0,56% peluang dieksploitasi; lebih tinggi dari 45,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://note-hxlab.wetolink.com/share/HG1CWbb7FVnq exploit · advisory pihak ketiga
• https://note-hxlab.wetolink.com/share/HG1CWbb7FVnq#-span--strong-step-1--trigger-password-reset-for-victim--st... exploit · advisory pihak ketiga
• https://vuldb.com/?id.339207 advisory pihak ketiga · vdb entry
• https://vuldb.com/?submit.720129 exploit · advisory pihak ketiga · vdb entry
• https://vuldb.com/?ctiid.339207 permissions required · vdb entry