PT-2025-33731 · Unknown · Plesk Obsidian

Aziz · Published 2025-08-19 · Updated 2025-09-26 · CVE-2025-54336

Positive Technologies · (AI Summary)

CVSS v3.1

9.8

Critical

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Plesk Obsidian version 18.0.70

Description: The isAdminPasswordValid function in Plesk Obsidian uses a weak comparison (==) which allows an attacker to bypass the administrator password if the correct password is in the format "0e" followed by any digit string. An attacker can then log in using any string that evaluates to 0.0, such as "0e0". This issue is located in the admin/plib/LoginManager.php file. Approximately 11.6 million services are estimated to be affected worldwide.

Recommendations: Plesk Obsidian version 18.0.70: Update to a newer version that addresses this authentication bypass issue. As a temporary workaround, consider restricting access to the admin/plib/LoginManager.php file until a patch is available.

Fix

Weakness Enumeration

CWE-697

Related Identifiers

CVE-2025-54336

Affected Products

Plesk Obsidian

References · 20

• https://nvd.nist.gov/vuln/detail/CVE-2025-54336 · Security Note
• https://t.me/pentestingnews/66601 · Telegram Post
• https://reddit.com/r/CVEWatch/comments/1mxxkel/top_10_trending_cves_23082025 · Reddit Post
• https://twitter.com/grok/status/1960914567573442706 · Twitter Post
• https://twitter.com/CVEnew/status/1957800450889249224 · Twitter Post
• https://twitter.com/cracbot/status/1959571444758941826 · Twitter Post
• https://twitter.com/fofabot/status/1958066694649462789 · Twitter Post
• https://twitter.com/the_yellow_fall/status/1958009744117166586 · Twitter Post
• https://t.me/cveNotify/133486 · Telegram Post
• https://twitter.com/Komodosec/status/1971591414082687087 · Twitter Post
• https://t.me/CVEtracker/30358 · Telegram Post
• https://twitter.com/fridaysecurity/status/1958011370630226234 · Twitter Post
• https://twitter.com/zoomeye_team/status/1958363839004901556 · Twitter Post
• https://reddit.com/r/CVEWatch/comments/1mx2e0z/top_10_trending_cves_22082025 · Reddit Post
• https://blog.aziz.tn/2025/08/cve-2025-54336.html · Note