PT-2025-26675 · Apache · Apache

Joel Chang Zhi Kai · Published 2025-06-23 · Updated 2025-06-24 · CVE-2025-48461

Positive Technologies (AI Summary)

CVSS v3.1

5.0

Medium

Base vector

AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions: Apache (affected versions not specified)

Description: The issue allows an unauthenticated attacker to conduct brute force guessing and account takeover due to predictable session cookies. This could potentially allow attackers to gain root, admin, or user access and reset passwords.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Restriction of Excessive Authentication Attempts

Weakness Enumeration

CWE-307

CWE-341

Related Identifiers

BDU:2025-08190

CVE-2025-48461

Affected Products

Apache

References · 5

• https://bdu.fstec.ru/vul/2025-08190 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-48461 · Security Note
• https://advantech.com/en/support/details/firmware-?id=1-1B835P3 · Note
• https://csa.gov.sg/alerts-and-advisories/alerts/al-2025-061 · Note
• https://t.me/cvetracker/26888 · Telegram Post