PT-2025-11588 · Sytel · Softdial Contact Center

Published 2025-03-18 · Updated 2025-10-21 · CVE-2025-2493

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Softdial Contact Center of Sytel Ltd (affected versions not specified)

Description The issue allows an attacker to manipulate the id parameter of the "/softdial/scheduler/load.php" endpoint to navigate beyond the intended directory, potentially allowing unauthorized access to sensitive files outside the expected scope.

Recommendations As a temporary workaround, consider restricting access to the "/softdial/scheduler/load.php" endpoint until a patch is available. Avoid using the id parameter in the affected endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2025-2493

Affected Products

Softdial Contact Center

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2025-2493 · Security Note
• https://t.me/cvenotify/115131 · Telegram Post
• https://incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-softdial-contact-center · Note
• https://twitter.com/WolfgangSesin/status/1901985175954927997 · Twitter Post
• https://t.me/cvedetector/20568 · Telegram Post
• https://twitter.com/cybercronai/status/1902091521102364760 · Twitter Post
• https://t.me/cvetracker/19360 · Telegram Post
• https://t.me/latest_high_impact_cve/1995 · Telegram Post
• https://twitter.com/CVEnew/status/1901961080102105483 · Twitter Post
• https://t.me/cveNotify/139608 · Telegram Post
• https://twitter.com/CveFindCom/status/1901959892463694263 · Twitter Post