CVE-2025-2407

Missing Authentication & Authorization in Web-API allows adversary unrestricted access

State: Published
Severity: 9.3 Critical
Published: May 27, 2025
Updated: May 27, 2025
Reserved: Mar 17, 2025

Description

Missing Authentication & Authorization in Web-API in Mobatime AMX MTAPI v6 on IIS allows adversaries to unrestricted access via the network. The vulnerability is fixed in Version 1.5.

Scores

CVSS	Score	Vector	Source
4.0	9.3 Critical	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/AU:Y/R:U	NCSC.ch

Weaknesses

CWE-306 Missing Authentication for Critical Function
CWE-862 Missing Authorization

Affected Products

Product	Versions
AMX MTAPIMobatime	6 and earlierAffected
AMXGT-100Mobatime	before 1.5Affected

References

https://mobatimemtsl.github.io/Vulnerability-References/

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.