PT-2025-39104 · Unknown · Vitogate 300

Souvik Kandar · Published 2025-09-23 · Updated 2025-09-23 · CVE-2025-9495

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Vitogate 300 (affected versions not specified)

Description The web interface does not properly enforce server-side authentication, relying instead on frontend-based authentication controls. This allows an attacker to bypass login restrictions by modifying HTML elements in the browser’s developer tools. By removing specific UI elements, an attacker can reveal the hidden administration menu, gaining full control over the device. The HTML elements can be modified to bypass login restrictions.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-602

Related Identifiers

CVE-2025-9495

Affected Products

Vitogate 300

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-9495 · Security Note
• https://t.me/CVEtracker/33121 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1970419018969260524 · Twitter Post
• https://twitter.com/CveFindCom/status/1970301956594839916 · Twitter Post
• https://twitter.com/CVEnew/status/1970393465792942442 · Twitter Post
• https://https//www.corporate.carrier.com/product-security/advisories-resources · Note