CVE-2025-56676

Katalog CVE

CVSS 5.4 · Medium EPSS 0,33%

Kerentanan Improper Restriction of Security Token Assignment pada titansystems zender. Skor CVSS 3.1 5.4 (Medium) menurut CISA ADP.

Deskripsi (NVD)

TitanSystems Zender v3.9.7 contains an account takeover vulnerability in its password reset functionality. A temporary password or reset token issued to one user can be used to log in as another user, due to improper validation of token-user linkage. This allows remote attackers to gain unauthorized access to any user account by exploiting the password reset mechanism. The vulnerability occurs because the reset token is not correctly bound to the requesting account and is accepted for other user emails during login, enabling privilege escalation and information disclosure.

Rincian

Terbit di NVD

30 September 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

5.4 (Medium), sumber CISA ADP
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-1259: Improper Restriction of Security Token Assignment

EPSS (30 hari)

0,33% peluang dieksploitasi; lebih tinggi dari 24,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://darklotus.medium.com/cve-2025-56676-critical-vulnerability-in-zender-gateway-allows-account-takeover-2... advisory pihak ketiga
• https://codecanyon.net/item/zender-android-mobile-devices-as-sms-gateway-saas-platform/26594230 product
• https://previews.titansystems.ph/zender/dashboard/auth permissions required