VULNERABILITY INTELLIGENCE

CVE-2025-54816

CVSS score9.4 CRITICAL
EPSS probability0.47%
CISA KEVNot currently listed
Published2026-01-22
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

Description

This vulnerability occurs when a WebSocket endpoint does not enforce proper authentication mechanisms, allowing unauthorized users to establish connections. As a result, attackers can exploit this weakness to gain unauthorized access to sensitive data or perform unauthorized actions. Given that no authentication is required, this can lead to privilege escalation and potentially compromise the security of the entire system.

Weakness classification

  • ics-cert@hq.dhs.gov: CWE-306

Primary references