PT-2025-21144 · Ezd Rp · Ezd Rp

Jakub Płatek · Published 2025-05-14 · Updated 2025-05-14 · CVE-2025-4430

Positive Technologies (AI Summary)

CVSS v4.0

8.6

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions: EZD RP versions prior to 20.19

Description: The issue allows unauthorized access to the "/api/Token/gettoken" endpoint in EZD RP, enabling file manipulation.

Recommendations: For versions prior to 20.19, update to version 20.19 or later to resolve the issue. As a temporary workaround, consider restricting access to the "/api/Token/gettoken" endpoint until a patch is available.

Fix

RCE

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2025-4430

Affected Products

Ezd Rp

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2025-4430 · Security Note
• https://twitter.com/VulmonFeeds/status/1922620863045656895 · Twitter Post
• https://t.me/latest_high_impact_cve/2363 · Telegram Post
• https://twitter.com/Carlos_LopezMkt/status/1922609495722614924 · Twitter Post
• https://cert.pl/en/posts/2025/05/CVE-2025-4430 · Note
• https://t.me/cvetracker/23823 · Telegram Post
• https://twitter.com/CveFindCom/status/1922608833332908496 · Twitter Post
• https://gov.pl/web/ezd-rp · Note
• https://twitter.com/CVEnew/status/1922695650761900077 · Twitter Post