CVEvulnerability

CVE-2025-30235

3.5 LOW Published 2025-03-19 Modified 2026-06-17 Official page ↗

Status: Deferred
Published: 2025-03-19
Last modified: 2026-06-17
Assigner: [email protected]
CVSS 3.1 ([email protected]): 3.5 LOW — CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N
Weaknesses: CWE-362

Description

Shearwater SecurEnvoy SecurAccess Enrol before 9.4.515 is intended to disable accounts that have had more than 10 failed authentication attempts, but instead allows hundreds of failed authentication attempts, because concurrent attempts are mishandled.

Weakness · CWE (1)

CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization weakness

References

https://reserge.org/probabilistically-breaking-securenvoy-totp/ reserge.org
https://securenvoy.com/wp-content/uploads/2025/03/Release-Notes-9.4.515.pdf securenvoy.com

CVE-2025-30235

Description

Related

Weakness · CWE (1)

References