CVE-2025-41086: gams — Katalog CVE

csirt@kutim:~/threat-intel/cve/CVE-2025-41086

CVSS 6.5 · Medium EPSS 0,21%

Kerentanan Authorization Bypass Through User-Controlled Key pada gams. Skor CVSS 3.1 6.5 (Medium) menurut NVD.

Deskripsi (NVD)

Vulnerability in the access control system of the GAMS licensing system that allows unlimited valid licenses to be generated, bypassing any usage restrictions. The validator uses an insecure checksum algorithm; knowing this algorithm and the format of the license lines, an attacker can recalculate the checksum and generate a valid license to grant themselves full privileges without credentials or access to the source code, allowing them unrestricted access to GAMS's mathematical models and commercial solvers.

Rincian

Terbit di NVD: 2 Desember 2025
Terakhir diubah: 17 Juni 2026
Status NVD: Analyzed
CVSS 3.1: 6.5 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-639: Authorization Bypass Through User-Controlled Key
EPSS (30 hari): 0,21% peluang dieksploitasi; lebih tinggi dari 10,8% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
gams	gams	Semua versi sebelum 48.7.0
gams	gams	Versi 49.1.0 hingga sebelum 49.7.0

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://www.incibe.es/en/incibe-cert/notices/aviso/authorization-bypass-gams-gams-development-corp advisory pihak ketiga
https://www.gams.com/latest/docs/RN_51.html release notes

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:11 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.