CVEvulnerability

CVE-2025-59090

9.3 CRITICAL Published 2026-01-26 Modified 2026-06-17 Official page ↗
Status
Deferred
Published
2026-01-26
Last modified
2026-06-17
Assigner
551230f0-3615-47bd-b7cc-93e92e730bbf
CVSS 4.0 (551230f0-3615-47bd-b7cc-93e92e730bbf)
9.3 CRITICAL — CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weaknesses
CWE-1188, CWE-306

Description

On the exos 9300 server, a SOAP API is reachable on port 8002. This API does not require any authentication prior to sending requests. Therefore, network access to the exos server allows e.g. the creation of arbitrary access log events as well as querying the 2FA PINs associated with the enrolled chip cards.

Related

Weakness · CWE (2)

  • CWE-1188 Initialization of a Resource with an Insecure Default weakness
  • CWE-306 Missing Authentication for Critical Functionality weakness

References