PT-2025-23436 · Unknown · Mist Community Edition

Alex Perrakis + 3 · Published 2025-06-01 · Updated 2025-11-25 · CVE-2025-5409

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Mist Community Edition versions up to 4.7.1

Description A critical issue has been found, affecting the create token function of the API Token Handler component. This leads to improper access controls, allowing remote attacks. The issue has been publicly disclosed and may be exploited.

Recommendations For Mist Community Edition versions up to 4.7.1, upgrade to version 4.7.2 to address this issue. As a temporary workaround, consider restricting access to the create token function of the API Token Handler component until the upgrade is applied.

Exploit

Fix

Improper Access Control

Incorrect Privilege Assignment

Weakness Enumeration

CWE-284

CWE-266

Related Identifiers

CVE-2025-5409

Affected Products

Mist Community Edition

References · 15

• 🔥 https://github.com/Stolichnayer/mist-ce-account-takeover · Exploit
• https://github.com/mistio/mist-ce/releases/tag/v4.7.2 · Patch
• https://github.com/mistio/mist.api/commit/db10ecb62ac832c1ed4924556d167efb9bc07fad · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-5409 · Security Note
• https://osv.dev/vulnerability/CVE-2025-5409 · Vendor Advisory
• https://twitter.com/cracbot/status/1930580427904844060 · Twitter Post
• https://vuldb.com/?submit.583531 · Note
• https://twitter.com/CVEnew/status/1929305865896731118 · Twitter Post
• https://t.me/cvenotify/124279 · Telegram Post
• https://vuldb.com/?id.310749 · Note
• https://t.me/latest_high_impact_cve/2511 · Telegram Post
• https://t.me/cveNotify/143943 · Telegram Post
• https://vuldb.com/?ctiid.310749 · Note
• https://t.me/cvetracker/25111 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1929307296296833162 · Twitter Post