CVE-2025-65002CWE-863broken-access-control

CVE-2025-65002

High · published November 12, 2025

CVSS v3.1
7.5
EPSS
0%
Percentile
19.9
In the wild
Unconfirmed
What it is

⚡ A username that's exactly 16 characters long can unlock some sneaky access in the Fujitsu iRMC S6 on M5! Think of it like a secret code for a VIP entrance that only works if you hit the exact character count — anything else, and the door won't budge. An attacker could exploit this quirky username length to gain unauthorized access, potentially altering configurations or accessing sensitive information. This could lead to an administrative nightmare, leaving your system exposed to further malicious activities!

Put simply

Think of it like a secret code for a VIP entrance that only works if you hit the exact character count — anything else, and the door won't budge. This vulnerability in Fujitsu iRMC S6 mishandles access control based on the specific length of usernames, allowing unauthorized actions when they are exactly 16 characters long, bypassing expected security measures.

What to do

An attacker could exploit this quirky username length to gain unauthorized access, potentially altering configurations or accessing sensitive information. This could lead to an administrative nightmare, leaving your system exposed to further malicious activities! To safeguard your systems, upgrade to version 1.37S or later immediately. Additionally, consider implementing stricter username validation to mitigate this exploit. Regularly review user access privileges as part of your ongoing security posture. You've got this! Fixing this issue is just a quick upgrade away! 🛡️

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00285 · 19.9th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2025-11-12T23:15Z
References (1)
EPSS history
Timeline
  • 12 NOV 00:00Z
    Fujitsu / Fsas Technologies iRMC S6 on M5 before 1.37S mishandles Redfish/WebUI access if the length of a username is exactly 16 characters
    cvelistv5