CVE-2025-41012CWE-862

Unauthorized access vulnerability in TCMAN GIM

High · published December 2, 2025

CVSS v4.0
8.7
EPSS
0%
Percentile
15.3
In the wild
Unconfirmed
What it is

Unauthorized access vulnerability in TCMAN GIM v11 version 20250304. This vulnerability allows an unauthenticated attacker to determine whether a user exists on the system by using the 'pda:userId' and 'pda:newPassword' parameters with 'soapaction UnlockUser’ in '/WS/PDAWebService.asmx'.

The record
Technical detail
CVSS v4.0
8.7 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00249 · 15.3th percentile
Weakness
CWE-862 · Missing Authorization
Published
2025-12-02T13:12Z
EPSS history
Timeline
  • 02 DEC 13:12Z
    Unauthorized access vulnerability in TCMAN GIM
    cvelistv5