PT-2025-22972 · Mobatime · Mobatime Amx Mtapi

Manuel Walder · Publicado 2025-05-27 · Atualizado 2025-05-27 · CVE-2025-2407

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Crítica

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/AU:Y/R:U

Name of the Vulnerable Software and Affected Versions Mobatime AMX MTAPI v6 versions prior to 1.5

Description The issue concerns Missing Authentication & Authorization in the Web-API of Mobatime AMX MTAPI v6 on IIS, allowing adversaries to gain unrestricted access via the network.

Recommendations For versions prior to 1.5, update to version 1.5 to resolve the issue. As a temporary workaround, consider restricting access to the Web-API to minimize the risk of exploitation.

Correção

Missing Authorization

Missing Authentication

Enumeração de Fraquezas

CWE-862

CWE-306

Identificadores relacionados

CVE-2025-2407

Produtos afetados

Mobatime Amx Mtapi

Referências · 8

• https://twitter.com/VulmonFeeds/status/1927286583612321951 · Publicação no Twitter
• https://twitter.com/CVEnew/status/1927278857872085451 · Publicação no Twitter
• https://t.me/cvetracker/24712 · Publicação no Telegram
• https://twitter.com/CveFindCom/status/1927276035579449369 · Publicação no Twitter
• https://mobatimemtsl.github.io/Vulnerability-References · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2025-2407 · Nota de Segurança
• https://t.me/latest_high_impact_cve/2470 · Publicação no Telegram
• https://t.me/cvenotify/123680 · Publicação no Telegram