PT-2025-26855 · Microsens · Microsens Nmp Web+

Noam Moshe + 1 · Published 2025-06-24 · Updated 2025-07-17 · CVE-2025-49151

Positive Technologies (AI Summary)

CVSS v2.0

9.4

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:N

Name of the Vulnerable Software and Affected Versions: MICROSENS NMP Web+ versions prior to 3.3.0

Description: The issue allows an unauthenticated attacker to generate forged JSON Web Tokens (JWT) to bypass authentication. This could potentially lead to full system control. Organizations worldwide remain at risk.

Recommendations: For versions prior to 3.3.0, update to version 3.3.0 to fix the issue. As a temporary workaround, consider restricting access to sensitive areas of the system to minimize the risk of exploitation. Avoid using the JWT token in authentication processes until the issue is resolved.

Fix

Weakness Enumeration

CWE-547

Related Identifiers

BDU:2026-00294

CVE-2025-49151

Affected Products

Microsens Nmp Web+

References · 10

• https://bdu.fstec.ru/vul/2026-00294 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-49151 · Security Note
• https://twitter.com/CveFindCom/status/1937921605532864639 · Twitter Post
• https://t.me/cvenotify/129295 · Telegram Post
• https://twitter.com/transilienceai/status/1940204810831020518 · Twitter Post
• https://cisa.gov/news-events/ics-advisories/icsa-25-175-07 · Note
• https://twitter.com/CVEnew/status/1937922814226448803 · Twitter Post
• https://t.me/true_secator/7185 · Telegram Post
• https://microsens.com/support/downloads/nmp · Note
• https://twitter.com/TweetThreatNews/status/1940044892710781387 · Twitter Post