CVE-2025-56333CWE-287

CVE-2025-56333

Critical · published December 29, 2025

CVSS v3.1
9.8
EPSS
1%
Percentile
42.1
In the wild
Unconfirmed
What it is

🚨 A clever attacker could exploit Fossorial's 2FA system to escalate privileges effortlessly—like finding a secret backdoor into a VIP lounge! 🔥 Think of it as a security guard at a concert who just lets anyone with a valid ticket backstage, without checking if they should actually be there. This vulnerability allows the attacker to bypass essential security checks, giving them access they shouldn’t have. With this privilege escalation, an attacker could gain unauthorized access to sensitive functions of the system—think changing settings, accessing confidential data, or even locking out legitimate users. The potential fallout could be absolutely devastating for organizations relying on Fossorial's security measures!

Put simply

Think of it as a security guard at a concert who just lets anyone with a valid ticket backstage, without checking if they should actually be there. This vulnerability allows the attacker to bypass essential security checks, giving them access they shouldn’t have. This vulnerability in Fossorial's 2FA component allows attackers to elevate their privileges by circumventing essential authentication checks, exposing systems to unauthorized actions.

What to do

With this privilege escalation, an attacker could gain unauthorized access to sensitive functions of the system—think changing settings, accessing confidential data, or even locking out legitimate users. The potential fallout could be absolutely devastating for organizations relying on Fossorial's security measures! To safeguard against this threat, immediately update to version 1.6.3 or later. Additionally, review your 2FA settings and implement robust security policies to ensure that only authorized users can access sensitive components. You've got this! Just follow these steps to secure your system and keep those cyber villains at bay! 🛡️

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00502 · 42.1th percentile
Weakness
CWE-287 · Improper Authentication
Published
2025-12-29T21:15Z
Affected products (1)
ProductVersionsFixed in
pangolin/pangolin< 1.7.01.7.0
References (3)
EPSS history
Timeline
  • 29 DEC 00:00Z
    An issue in Fossorial fosrl/pangolin v.1.6.2 and before allows a remote attacker to escalate privileges via the 2FA component
    cvelistv5