PT-2025-26483 · Dnn · Dnn

Valadas · Published 2025-02-20 · Updated 2025-09-15 · CVE-2025-52487

Positive Technologies (AI Summary)

CVSS v4.0

8.8

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions: DNN (formerly DotNetNuke) versions 7.0.0 through 10.0.0

Description: The issue allows a specially crafted request or proxy to bypass the design of DNN Login IP Filters, enabling login attempts from IP addresses not in the allow list. This has been patched in version 10.0.1.

Recommendations: For versions 7.0.0 through 10.0.0, update to version 10.0.1 to resolve the issue. As a temporary workaround, consider restricting access to the DNN Login IP Filters to minimize the risk of exploitation.

Exploit

Fix

Incorrect Authorization

Improper Check for Exceptional Conditions

Weakness Enumeration

CWE-863

CWE-754

Related Identifiers

BDU:2025-02490

CVE-2025-52487

GHSA-FJHG-3MRH-MM7H

Affected Products

Dnn

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/52xxx/CVE-2025-52487.json · Exploit
• https://github.com/dnnsoftware/Dnn.Platform/security/advisories/GHSA-fjhg-3mrh-mm7h · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-02490 · Security Note
• https://osv.dev/vulnerability/CVE-2025-52487 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-52487 · Security Note
• https://osv.dev/vulnerability/GHSA-fjhg-3mrh-mm7h · Vendor Advisory
• https://github.com/dnnsoftware/Dnn.Platform · Note
• https://github.com/dnnsoftware/Dnn.Platform/releases/tag/v10.0.1 · Note
• https://t.me/latest_high_impact_cve/2750 · Telegram Post
• https://twitter.com/CVEnew/status/1936472499857895680 · Twitter Post
• https://t.me/cveNotify/135484 · Telegram Post
• https://t.me/cvetracker/26732 · Telegram Post