PT-2025-30411 · Etq · Etq Reliance

Published 2025-07-22 · Updated 2025-07-22 · CVE-2025-34140

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions ETQ Reliance versions prior to SE.2025.1 ETQ Reliance versions prior to 2025.1.2

Description An authorization bypass allows an unauthenticated attacker to retrieve limited sensitive resources by appending a specific URI suffix to certain API endpoints. The issue stems from a misconfiguration in API authorization logic.

Recommendations Update to version SE.2025.1 or later. Update to version 2025.1.2 or later.

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2025-34140

Affected Products

Etq Reliance

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2025-34140 · Security Note
• https://t.me/cvetracker/28373 · Telegram Post
• https://etq.com/product-overview · Note
• https://vulncheck.com/advisories/etq-reliance-cg-nxg-api-authorization-bypass-via-localized-text-uri-suffix · Note
• https://etq.com/blog/etq-reliance-security-update · Patch, Vendor Advisory
• https://twitter.com/VulmonFeeds/status/1947658332744880368 · Twitter Post
• https://t.me/CVEtracker/28373 · Telegram Post
• https://twitter.com/CVEnew/status/1947648599615017173 · Twitter Post