CVE-2025-30236CWE-472

Shearwater SecurEnvoy SecurAccess Enrol before 9.4.515 allows authentication through only a six-digit TOTP code (skipping a password check) if an HTTP POST…

High · published March 19, 2025

CVSS v3.1
8.6
EPSS
0%
Percentile
29.1
In the wild
Unconfirmed
What it is

Shearwater SecurEnvoy SecurAccess Enrol before 9.4.515 allows authentication through only a six-digit TOTP code (skipping a password check) if an HTTP POST request contains a SESSION parameter.

The record
Technical detail
CVSS v3.1
8.6 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00365 · 29.1th percentile
Weakness
CWE-472 · External Control of Assumed-Immutable Web Parameter
Published
2025-03-19T00:00Z
EPSS history
Timeline
  • 19 MAR 00:00Z
    Shearwater SecurEnvoy SecurAccess Enrol before 9.4.515 allows authentication through only a six-digit TOTP code (skipping a password check) if an HTTP POST…
    cvelistv5