CVE-2025-4558
WormHole Tech GPM - Unverified Password Change
- State
- Published
- Severity
- 9.3 Critical
- Published
- May 12, 2025
- Updated
- May 12, 2025
- Reserved
- May 12, 2025
Description
The GPM from WormHole Tech has an Unverified Password Change vulnerability, allowing unauthenticated remote attackers to change any user's password and use the modified password to log into the system.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 9.3 Critical | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | twcert |
| 3.1 | 9.8 Critical | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | twcert |
Weaknesses
- CWE-620 Unverified Password Change
Affected Products
| Product | Versions |
|---|---|
GPMWormHole Tech |
|
References
- https://www.twcert.org.tw/tw/cp-132-10114-10b4b-1.htmlthird-party-advisory
- https://www.twcert.org.tw/en/cp-139-10115-f5f14-2.htmlthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.