CVE-2025-2407CWE-306CWE-862

Missing Authentication & Authorization in Web-API allows adversary unrestricted access

Critical · published May 27, 2025

CVSS v4.0
9.3
EPSS
0%
Percentile
41.0
In the wild
Unconfirmed
What it is

Missing Authentication & Authorization in Web-API in Mobatime AMX MTAPI v6 on IIS allows adversaries to unrestricted access via the network. The vulnerability is fixed in Version 1.5.

The record
Technical detail
CVSS v4.0
9.3 · CRITICAL
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/AU:Y/R:U
EPSS
0.00487 · 41.0th percentile
Weaknesses
CWE-306 · Missing Authentication for Critical Function; CWE-862 · Missing Authorization
Published
2025-05-27T07:52Z
EPSS history
Timeline
  • 27 MAY 07:52Z
    Missing Authentication & Authorization in Web-API allows adversary unrestricted access
    cvelistv5