PT-2025-24428 · Tcman · Tcman'S Gim

Published 2025-06-09 · Updated 2025-06-09 · CVE-2025-40668

Positive Technologies (AI Summary)

CVSS v4.0

7.1

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions TCMAN's GIM version 11

Description The issue is related to an incorrect authorization vulnerability. This vulnerability allows an attacker with a low privilege level to change the password of other users through a POST request using the parameters idUser, PasswordActual, PasswordNew, and PasswordNewRepeat in the "/PC/WebService.aspx/validateChangePasswordña" API endpoint. To exploit the vulnerability, the PasswordActual parameter must be empty.

Recommendations For TCMAN's GIM version 11, as a temporary workaround, consider restricting access to the "/PC/WebService.aspx/validateChangePasswordña" API endpoint to minimize the risk of exploitation. Avoid using the PasswordActual parameter in this endpoint until the issue is resolved. Additionally, restrict the use of the idUser, PasswordNew, and PasswordNewRepeat parameters in this context to prevent unauthorized password changes.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2025-40668

Affected Products

Tcman'S Gim

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-40668 · Security Note
• https://osv.dev/vulnerability/CVE-2025-40668 · Vendor Advisory
• https://twitter.com/CVEnew/status/1932062623081857466 · Twitter Post
• https://t.me/latest_high_impact_cve/2591 · Telegram Post
• https://t.me/cvetracker/25775 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1932118711961354717 · Twitter Post
• https://incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-tcman-gim-1 · Note