CVE-2025-24924CWE-306

GMOD Apollo Missing Authentication for Critical Function

Critical · published March 5, 2025

CVSS v4.0
9.3
EPSS
1%
Percentile
45.9
In the wild
Unconfirmed
What it is

🚨 A sneaky oversight in GMOD Apollo lets anyone impersonate an admin without even breaking a sweat! 🔥 Think of it like a restaurant where anyone can waltz into the back kitchen and start cooking, without ever having to show a chef's certificate. It’s the kind of recipe for disaster that can leave your whole establishment in chaos! An attacker could effortlessly gain administrative access and take control of the server, potentially altering settings, accessing sensitive data, or even shutting the whole system down. This could lead to a catastrophic breach that puts all users at risk and severely disrupts operations, making it absolutely devastating for everyone involved!

Put simply

Think of it like a restaurant where anyone can waltz into the back kitchen and start cooking, without ever having to show a chef's certificate. It’s the kind of recipe for disaster that can leave your whole establishment in chaos! This vulnerability arises because certain functions in GMOD Apollo do not require proper authentication when supplied with an administrative username, allowing unauthorized users to execute sensitive commands.

What to do

An attacker could effortlessly gain administrative access and take control of the server, potentially altering settings, accessing sensitive data, or even shutting the whole system down. This could lead to a catastrophic breach that puts all users at risk and severely disrupts operations, making it absolutely devastating for everyone involved! Immediately patch GMOD Apollo to the latest version that addresses this vulnerability. Ensure that all necessary authentication checks are implemented for administrative functions and conduct a security audit to prevent future issues. You've got this! By taking swift action, you can secure your system and maintain your hero status. 🛡️

The record
Technical detail
CVSS v4.0
9.3 · CRITICAL
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00565 · 45.9th percentile
Weakness
CWE-306 · Missing Authentication for Critical Function
Published
2025-03-05T00:02Z
EPSS history
Timeline
  • 05 MAR 00:02Z
    GMOD Apollo Missing Authentication for Critical Function
    cvelistv5