PT-2025-31459 · Exagrid · Exagrid Ex10

0Xsu3Ks · Published 2025-07-30 · Updated 2025-07-31 · CVE-2025-29556

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions ExaGrid EX10 versions 6.3 through 7.0.1.P08

Description ExaGrid EX10 versions 6.3 through 7.0.1.P08 are susceptible to an incorrect access control issue. Starting with version 6.3, ExaGrid implemented restrictions to prevent users with the Admin role from creating or modifying users with the Security Officer role without proper authorization. However, a flaw in the account creation process allows an attacker to bypass these restrictions through manipulation of API requests. An attacker possessing Admin access can intercept and modify the API request during user creation, altering parameters to assign the new account to the ExaGrid Security Officers group without the necessary approval. The vulnerability involves manipulating API requests during the user creation process.

Recommendations ExaGrid EX10 version 6.3: Restrict access to the user creation API endpoint. ExaGrid EX10 versions 6.3 through 7.0.1.P08: Carefully review and validate all API requests related to user creation and modification to ensure proper authorization checks are enforced.

Exploit

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2025-29556

Affected Products

Exagrid Ex10

References · 7

• 🔥 https://github.com/0xsu3ks/CVE-2025-29556 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-29556 · Security Note
• https://t.me/CVEtracker/28868 · Telegram Post
• https://exagrid.com · Note
• https://twitter.com/VulmonFeeds/status/1950694504001900602 · Twitter Post
• https://twitter.com/CVEnew/status/1950962867550785897 · Twitter Post
• https://t.me/cveNotify/130413 · Telegram Post