PT-2025-23149 · Unknown · Client.Php

Anna Katarina Quinn · Published 2025-05-29 · Updated 2025-09-05 · CVE-2025-48045

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions The product name cannot be determined.

Description An unauthenticated HTTP GET request to the "/client.php" endpoint will disclose the default administrator user credentials.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

OS Command Injection

Weakness Enumeration

CWE-201

CWE-78

Related Identifiers

BDU:2026-00244

BDU:2026-00245

CVE-2025-48045

Affected Products

Client.Php

References · 17

• https://bdu.fstec.ru/vul/2026-00244 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-48045 · Security Note
• https://bdu.fstec.ru/vul/2026-00245 · Security Note
• https://rapid7.com/blog/post/2025/05/29/cve-2025-48045-cve-2025-48046-cve-2025-48047-mici-netfax-server-product-vulnerabilities-not-fixed · Note
• https://twitter.com/davidi99/status/1928157194152824870 · Twitter Post
• https://twitter.com/CVEnew/status/1928084562170573299 · Twitter Post
• https://t.me/cvenotify/123964 · Telegram Post
• https://twitter.com/buzz_sec/status/1928059984450846804 · Twitter Post
• https://t.me/cvetracker/24888 · Telegram Post
• https://twitter.com/CveFindCom/status/1928076679416578088 · Twitter Post
• https://t.me/cvenotify/123962 · Telegram Post
• https://twitter.com/cybercronai/status/1928413751226572831 · Twitter Post
• https://twitter.com/transilienceai/status/1928254180831154471 · Twitter Post
• https://t.me/cveNotify/134375 · Telegram Post
• https://twitter.com/transilienceai/status/1928432138430353907 · Twitter Post