CVE-2025-30236

High

Shearwater SecurEnvoy SecurAccess Enrol before 9.4.515 allows authentication through only a six-digit TOTP code (skipping a password check)…

mitre·CWE-472·Published 2025-03-19

CVSS

8.6

EPSS

0.00

KEV

Exploits

cve.orgen

193 chars

Shearwater SecurEnvoy SecurAccess Enrol before 9.4.515 allows authentication through only a six-digit TOTP code (skipping a password check) if an HTTP POST request contains a SESSION parameter.

NVDen

193 chars

Shearwater SecurEnvoy SecurAccess Enrol before 9.4.515 allows authentication through only a six-digit TOTP code (skipping a password check) if an HTTP POST request contains a SESSION parameter.

La inscripción a Shearwater SecurEnvoy SecurAccess anterior a la versión 9.4.515 permite la autenticación únicamente a través de un código TOTP de seis dígitos (omitiendo la verificación de contraseña) si una solicitud HTTP POST contiene un parámetro SESSION.

CVSS metrics across sources

Version	Type	Source	Base	Exp	Impact	Vector
3.1	Primary	cve.org	8.6	—	—	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N
3.1	Primary	cve.org	8.6	—	—	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N
3.1	Secondary	NVD	8.6	3.9	4.0	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N