CVE-2025-36535CWE-306

AutomationDirect MB-Gateway Missing Authentication for Critical Function

Critical · published May 21, 2025

CVSS v4.0
10.0
EPSS
1%
Percentile
69.1
In the wild
Unconfirmed
What it is

🚨 The embedded web server is an open door with no lock! Anyone could waltz in and make changes or run code that disrupts your operations. 🔥 Think of it like a restaurant that forgot to lock its side door — anyone can stroll in, move furniture around, or start cooking without a chef's permission. As chaos unfolds in the kitchen, diners are left wondering what's going on! An unrestricted access flaw like this is absolutely devastating! An attacker could change your configuration settings, bring operations to a standstill, or even execute malicious code, leading to potential data breaches and severe downtime for your systems. This vulnerability poses a critical risk to your entire infrastructure!

Put simply

Think of it like a restaurant that forgot to lock its side door — anyone can stroll in, move furniture around, or start cooking without a chef's permission. As chaos unfolds in the kitchen, diners are left wondering what's going on! This vulnerability allows unauthorized remote access to the embedded web server due to the lack of authentication and access controls, enabling attackers to manipulate configurations or execute arbitrary code based on system functionality.

What to do

An unrestricted access flaw like this is absolutely devastating! An attacker could change your configuration settings, bring operations to a standstill, or even execute malicious code, leading to potential data breaches and severe downtime for your systems. This vulnerability poses a critical risk to your entire infrastructure! Immediately secure the embedded web server by implementing strict authentication mechanisms and access controls. Review configurations and apply the latest security patches to mitigate potential exploits. Regularly audit your systems to ensure compliance and security best practices! You’ve got this! Fixing this flaw will protect your operations and transform you into a security hero! 🛡️

The record
Technical detail
CVSS v4.0
10.0 · CRITICAL
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
EPSS
0.01245 · 69.1th percentile
Weakness
CWE-306 · Missing Authentication for Critical Function
Published
2025-05-21T19:52Z
EPSS history
Timeline
  • 21 MAY 19:52Z
    AutomationDirect MB-Gateway Missing Authentication for Critical Function
    cvelistv5