PT-2025-30399 · Unknown · Etq Reliance

Published 2025-07-22 · Updated 2025-07-22 · CVE-2025-34143

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions ETQ Reliance versions prior to MP-4583

Description An authentication bypass allows login as the privileged internal SYSTEM user by manipulating the username field. The SYSTEM account does not require a password, enabling attackers with network access to the login page to obtain elevated access. Once authenticated, an attacker could achieve remote code execution by modifying Jython scripts within the application.

Recommendations Update to version MP-4583 or later.

Fix

RCE

Improper Privilege Management

Authentication Bypass Using an Alternate Path or Channel

OS Command Injection

Weakness Enumeration

CWE-269

CWE-288

CWE-78

Related Identifiers

CVE-2025-34143

Affected Products

Etq Reliance

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2025-34143 · Security Note
• https://etq.com/product-overview · Note
• https://twitter.com/CVEnew/status/1947648602769174719 · Twitter Post
• https://slcyber.io/assetnote-security-research-center/how-we-accidentally-discovered-a-remote-code-execution-vulnerability-in-etq-reliance · Note
• https://t.me/CVEtracker/28376 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1947650652001251534 · Twitter Post
• https://etq.com/blog/etq-reliance-security-update · Patch, Vendor Advisory
• https://t.me/cvetracker/28376 · Telegram Post
• https://twitter.com/infosec_au/status/1947566524749025427 · Twitter Post
• https://vulncheck.com/advisories/etq-reliance-cg-authentication-bypass-via-trailing-space-rce · Note