PT-2025-11666 · Shearwater · Shearwater Securenvoy Securaccess

Published 2025-03-19 · Updated 2025-03-24 · CVE-2025-30236

Positive Technologies (AI Summary)

CVSS v3.1

8.6

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Shearwater SecurEnvoy SecurAccess versions prior to 9.4.515

Description The issue allows authentication through only a six-digit TOTP code, skipping a password check, if an HTTP POST request contains a SESSION parameter. This is related to external control of assumed-immutable web parameters.

Recommendations For versions prior to 9.4.515, update to version 9.4.515 or later to resolve the issue. As a temporary workaround, consider restricting access to the authentication endpoint to minimize the risk of exploitation. Avoid using the SESSION parameter in HTTP POST requests until the issue is resolved.

Fix

Weakness Enumeration

CWE-472

Related Identifiers

CVE-2025-30236

Affected Products

Shearwater Securenvoy Securaccess

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2025-30236 · Security Note
• https://t.me/cvedetector/20617 · Telegram Post
• https://t.me/latest_high_impact_cve/1998 · Telegram Post
• https://reserge.org/probabilistically-breaking-securenvoy-totp · Note
• https://twitter.com/cracbot/status/1904126126668333063 · Twitter Post
• https://twitter.com/CVEnew/status/1902250655924023422 · Twitter Post
• https://twitter.com/CveFindCom/status/1902246652158890176 · Twitter Post
• https://t.me/cvenotify/115300 · Telegram Post
• https://securenvoy.com/wp-content/uploads/2025/03/Release-Notes-9.4.515.pdf · Note
• https://t.me/cvenotify/115301 · Telegram Post
• https://t.me/cvetracker/19425 · Telegram Post