PT-2025-22972 · Mobatime · Mobatime Amx Mtapi

Manuel Walder · Published 2025-05-27 · Updated 2025-05-27 · CVE-2025-2407

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/AU:Y/R:U

Name of the Vulnerable Software and Affected Versions Mobatime AMX MTAPI v6 versions prior to 1.5

Description The issue concerns Missing Authentication & Authorization in the Web-API of Mobatime AMX MTAPI v6 on IIS, allowing adversaries to gain unrestricted access via the network.

Recommendations For versions prior to 1.5, update to version 1.5 to resolve the issue. As a temporary workaround, consider restricting access to the Web-API to minimize the risk of exploitation.

Fix

Missing Authorization

Missing Authentication

Weakness Enumeration

CWE-862

CWE-306

Related Identifiers

CVE-2025-2407

Affected Products

Mobatime Amx Mtapi

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2025-2407 · Security Note
• https://twitter.com/VulmonFeeds/status/1927286583612321951 · Twitter Post
• https://twitter.com/CVEnew/status/1927278857872085451 · Twitter Post
• https://t.me/cvetracker/24712 · Telegram Post
• https://twitter.com/CveFindCom/status/1927276035579449369 · Twitter Post
• https://mobatimemtsl.github.io/Vulnerability-References · Note
• https://t.me/latest_high_impact_cve/2470 · Telegram Post
• https://t.me/cvenotify/123680 · Telegram Post