CVE-2025-2410CWE-99

Admin Authorized Port (iptables) manipulation (open/close/disable ports)

High · published May 22, 2025

CVSS v4.0
8.9
EPSS
0%
Percentile
41.7
In the wild
Unconfirmed
What it is

⚡ If your session administrator credentials get compromised, attackers can control TCP/IP port access in ASPECT! That's a whole new level of scary! 🔥 Think of this like a security guard at a concert who has lost their badge; anyone can waltz in and access areas they shouldn't. Without proper credential protection, it's a free-for-all backstage pass! An attacker could manipulate the TCP/IP ports, potentially intercepting or redirecting crucial data traffic. This could lead to unauthorized access to sensitive systems, putting your entire network at risk of devastating breaches and data loss. Yikes!

Put simply

Think of this like a security guard at a concert who has lost their badge; anyone can waltz in and access areas they shouldn't. Without proper credential protection, it's a free-for-all backstage pass! This vulnerability allows attackers to control TCP/IP port access due to compromised session administrator credentials, affecting ASPECT-Enterprise, NEXUS Series, and MATRIX Series up to version 3.08.03.

What to do

An attacker could manipulate the TCP/IP ports, potentially intercepting or redirecting crucial data traffic. This could lead to unauthorized access to sensitive systems, putting your entire network at risk of devastating breaches and data loss. Yikes! Immediately update to the latest versions of ASPECT-Enterprise, NEXUS Series, and MATRIX Series beyond 3.08.03. Strengthen your credential management practices by enabling multi-factor authentication and regularly auditing access logs to spot any suspicious activity. You've got this! Follow these steps, and you'll tighten up your security in no time! 🛡️

The record
Technical detail
CVSS v4.0
8.9 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/S:N/AU:N/R:U/V:C
EPSS
0.00496 · 41.7th percentile
Weakness
CWE-99 · Improper Control of Resource Identifiers ('Resource Injection')
Published
2025-05-22T17:32Z
EPSS history
Timeline
  • 22 MAY 17:32Z
    Admin Authorized Port (iptables) manipulation (open/close/disable ports)
    cvelistv5