CVE-2025-2311CWE-319CWE-522CWE-648

Authentication Bypass in Sechard Information Technologies' SecHard

Critical · published March 20, 2025

CVSS v3.1
9.0
EPSS
0%
Percentile
6.5
In the wild
Unconfirmed
What it is

🚨 A critical flaw lets attackers waltz right past authentication in Sechard's SecHard, making it shockingly easy to manipulate the interface and harvest sensitive data! 🔥 Think of it like a restaurant where the staff never check who’s walking in — anyone can stroll into the kitchen, change the menu, or take all the secret recipes! 🍽️ An attacker could exploit this vulnerability to bypass authentication entirely, gaining unauthorized access to sensitive data and controls. This could lead to devastating information leaks or even manipulation of critical system functions, making it a serious threat to your security!

Put simply

Think of it like a restaurant where the staff never check who’s walking in — anyone can stroll into the kitchen, change the menu, or take all the secret recipes! 🍽️ This vulnerability arises from the incorrect use of privileged APIs, allowing authentication bypass and interface manipulation, while sensitive information is transmitted in cleartext, putting your credentials at risk.

What to do

An attacker could exploit this vulnerability to bypass authentication entirely, gaining unauthorized access to sensitive data and controls. This could lead to devastating information leaks or even manipulation of critical system functions, making it a serious threat to your security! Immediate action is required: Upgrade to SecHard version 3.3.0.20220411 or later to patch this vulnerability. Additionally, ensure all sensitive data is encrypted in transit and review API usage for proper authentication practices. You've got this! Follow these steps and you’ll be back in control in no time! 🛡️

The record
Technical detail
CVSS v3.1
9.0 · CRITICAL
Vector
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00174 · 6.5th percentile
Weaknesses
CWE-319 · Cleartext Transmission of Sensitive Information; CWE-522 · Insufficiently Protected Credentials; CWE-648 · Incorrect Use of Privileged APIs
Published
2025-03-20T11:55Z
EPSS history
Timeline
  • 20 MAR 11:55Z
    Authentication Bypass in Sechard Information Technologies' SecHard
    cvelistv5