CVE-2025-6979CWE-287

CVE-2025-6979

High · published October 23, 2025

CVSS v3.1
8.8
EPSS
1%
Percentile
44.0
In the wild
Unconfirmed
What it is

⚡ The Captive Portal is letting users slip through the digital cracks, allowing a cheeky authentication bypass! 😲 Think of it as a hotel lobby with a doorman who’s too friendly — they’ll let anyone in without checking if they have a reservation. This vulnerability means unauthorized users could access restricted areas without proper credentials. An attacker could easily waltz in, bypassing security features meant to protect sensitive information. This means they could potentially access personal data, manipulate configurations, or even launch further attacks from within the network — a serious breach of trust!

Put simply

Think of it as a hotel lobby with a doorman who’s too friendly — they’ll let anyone in without checking if they have a reservation. This vulnerability means unauthorized users could access restricted areas without proper credentials. This vulnerability occurs in the Captive Portal, where insufficient verification allows unauthorized access to the system without valid credentials. Essentially, it’s a flaw in the authentication process that could be exploited by anyone on the network.

What to do

An attacker could easily waltz in, bypassing security features meant to protect sensitive information. This means they could potentially access personal data, manipulate configurations, or even launch further attacks from within the network — a serious breach of trust! Immediately patch to the latest version of the Captive Portal software to close this loophole. Additionally, review authentication mechanisms to ensure strict checks are enforced. Regular audits of user access can also help safeguard against unauthorized entries. You’ve got this! By taking these steps, you’ll fortify your defenses and keep your network secure. 🛡️

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00530 · 44.0th percentile
Weakness
CWE-287 · Improper Authentication
Published
2025-10-23T23:15Z
References (1)
EPSS history
Timeline
  • 23 OCT 18:46Z
    Captive Portal can allow authentication bypass
    cvelistv5