PT-2025-12330 · Nebula Informatics · Sechard

Published 2025-03-20 · Updated 2026-06-06 · CVE-2025-2311

Positive Technologies (AI Summary)

CVSS v3.1

9.0

Critical

Base vector

AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Nebula Informatics SecHard versions prior to 3.3.0.20220411

Description The issue is related to the incorrect use of privileged APIs, cleartext transmission of sensitive information, and insufficiently protected credentials. This allows for authentication bypass, interface manipulation, authentication abuse, and harvesting information via API event monitoring.

Recommendations For versions prior to 3.3.0.20220411, update to version 3.3.0.20220411 or later to resolve the issue. As a temporary workaround, consider restricting access to privileged APIs and sensitive information to minimize the risk of exploitation. Additionally, ensure that credentials are properly protected and consider disabling API event monitoring until the issue is resolved.

Fix

Cleartext Transmission of Sensitive Information

Insufficiently Protected Credentials

Weakness Enumeration

CWE-319

CWE-648

CWE-522

Related Identifiers

CVE-2025-2311

Affected Products

Sechard

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2025-2311 · Security Note
• https://twitter.com/CVEnew/status/1902707064595771788 · Twitter Post
• https://t.me/latest_high_impact_cve/2011 · Telegram Post
• https://t.me/cvedetector/20730 · Telegram Post
• https://t.me/cvetracker/19538 · Telegram Post
• https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-25-0074 · Note
• https://t.me/cveNotify/166372 · Telegram Post
• https://twitter.com/cracbot/status/1904488525221019928 · Twitter Post
• https://t.me/cvenotify/115619 · Telegram Post
• https://usom.gov.tr/bildirim/tr-25-0074 · Note