PT-2025-23123 · Unknown · Absolute Secure Access

CVE-2025-27702 · Publicado 2025-05-28 · Atualizado 2025-06-04

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Média

Vetor base

AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Absolute Secure Access versions prior to 13.54

Description The issue allows attackers with administrative access to the management console and specific permissions to bypass those permissions, improperly modifying settings. The attack complexity is low, with no preexisting attack requirements, high privileges required, and no user interaction needed. There is no impact to system confidentiality or availability, but the impact to system integrity is high.

Recommendations For versions prior to 13.54, update to version 13.54 or later to resolve the issue. As a temporary workaround, consider restricting administrative access to the management console and limiting permissions to minimize the risk of exploitation.

Correção

LPE

Improper Access Control

Enumeração de Fraquezas

CWE-284

Identificadores relacionados

CVE-2025-27702

Produtos afetados

Absolute Secure Access

Referências · 7

• https://t.me/cvenotify/123938 · Publicação no Telegram
• https://twitter.com/dailycve/status/1930318494693830878 · Publicação no Twitter
• https://twitter.com/CVEnew/status/1927830334391070977 · Publicação no Twitter
• https://t.me/cvetracker/24866 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2025-27702 · Nota de Segurança
• https://absolute.com/platform/vulnerability-archive/cve-2025-27702 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2025-27702 · Aviso do Fabricante