PT-2025-11665 · Shearwater · Shearwater Securenvoy Securaccess

Published 2025-03-19 · Updated 2025-03-19 · CVE-2025-30235

Positive Technologies (AI Summary)

CVSS v3.1

3.5

Low

Base vector

AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Shearwater SecurEnvoy SecurAccess Enrol versions prior to 9.4.515

Description The issue concerns the mishandling of concurrent authentication attempts. Shearwater SecurEnvoy SecurAccess Enrol is intended to disable accounts after more than 10 failed authentication attempts, but due to incorrect handling of simultaneous attempts, it allows hundreds of failed authentication attempts instead.

Recommendations For versions prior to 9.4.515, update to version 9.4.515 or later to resolve the issue.

Fix

Race Condition

Weakness Enumeration

CWE-362

Related Identifiers

CVE-2025-30235

Affected Products

Shearwater Securenvoy Securaccess

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-30235 · Security Note
• https://t.me/cvenotify/115299 · Telegram Post
• https://t.me/cvedetector/20618 · Telegram Post
• https://securenvoy.com/wp-content/uploads/2025/03/Release-Notes-9.4.515.pdf · Note
• https://reserge.org/probabilistically-breaking-securenvoy-totp · Note
• https://twitter.com/CVEnew/status/1902250654946779323 · Twitter Post
• https://t.me/cvetracker/19424 · Telegram Post