CVE-2025-61977CWE-640

CVE-2025-61977

High · published October 24, 2025

CVSS v3.1
7.0
EPSS
0%
Percentile
3.2
In the wild
Unconfirmed
What it is

⚡ Just one recovery question can unlock an encrypted project — and it’s lurking in Productivity Suite v4.4.1.19! 🔓 Think of it like a hotel that only asks a single question to verify your identity before handing you a room key. If someone knows the right answer, they could snoop around like an uninvited guest! An attacker could easily decrypt sensitive project files merely by answering that question correctly, potentially exposing confidential information or proprietary data. It's a high-stakes game where the consequences could be major breaches of privacy and trust!

Put simply

Think of it like a hotel that only asks a single question to verify your identity before handing you a room key. If someone knows the right answer, they could snoop around like an uninvited guest! This vulnerability stems from a weak password recovery mechanism that allows attackers to gain access to encrypted content using just one recovery question — a dangerous oversight in user authentication.

What to do

An attacker could easily decrypt sensitive project files merely by answering that question correctly, potentially exposing confidential information or proprietary data. It's a high-stakes game where the consequences could be major breaches of privacy and trust! To mitigate this risk, immediately upgrade to a patched version of the software. Additionally, implement more robust recovery mechanisms that require multiple authentication factors to ensure only the rightful owner can access encrypted projects. You've got this! With these steps, you can strengthen your defenses and keep your data safe! 🛡️

The record
Technical detail
CVSS v3.1
7.0 · HIGH
Vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00142 · 3.2th percentile
Weakness
CWE-640 · Weak Password Recovery Mechanism for Forgotten Password
Published
2025-10-24T02:15Z
References (4)
EPSS history
Timeline
  • 23 OCT 21:51Z
    AutomationDirect Productivity Suite Weak Password Recovery Mechanism for Forgotten Password
    cvelistv5