PT-2025-20680 · Wormhole Tech · Wormhole Tech Gpm

Published 2025-05-12 · Updated 2025-05-17 · CVE-2025-4558

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions WormHole Tech GPM versions prior to 202502

Description The issue allows unauthenticated remote attackers to change any user's password and use the modified password to log into the system. This is due to an Unverified Password Change vulnerability. Remote attackers can exploit this to gain unauthorized access to the system.

Recommendations For versions prior to 202502, update to a version 202502 or later to resolve the issue. As a temporary workaround, consider restricting access to password change functionality until a patch is available. Avoid using password change features in the affected GPM until the issue is resolved.

Fix

Weakness Enumeration

CWE-620

Related Identifiers

CVE-2025-4558

Affected Products

Wormhole Tech Gpm

References · 12

• https://nvd.nist.gov/vuln/detail/CVE-2025-4558 · Security Note
• https://twitter.com/cracbot/status/1923332698271265204 · Twitter Post
• https://t.me/cvedetector/25065 · Telegram Post
• https://t.me/cvenotify/121712 · Telegram Post
• https://twitter.com/CVEnew/status/1921772905647489238 · Twitter Post
• https://twitter.com/CveFindCom/status/1921770393167159564 · Twitter Post
• https://t.me/latest_high_impact_cve/2337 · Telegram Post
• https://twcert.org.tw/tw/cp-132-10114-10b4b-1.html · Note
• https://t.me/cvetracker/23599 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1921786245899849893 · Twitter Post
• https://twitter.com/cracbot/status/1923695085977252145 · Twitter Post
• https://twcert.org.tw/en/cp-139-10115-f5f14-2.html · Note