PT-2025-40002 · Titansystems · Zender

Darklotus · Published 2025-09-30 · Updated 2025-12-23 · CVE-2025-56676

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L

Name of the Vulnerable Software and Affected Versions TitanSystems Zender version 3.9.7

Description TitanSystems Zender version 3.9.7 has an account takeover issue in its password reset feature. A temporary password or reset token for one user can be used to log in as another user because of incorrect validation of the token-user connection. This allows remote attackers to gain unauthorized access to user accounts by exploiting the password reset mechanism. The issue happens because the reset token is not correctly linked to the account requesting it and is accepted for other user emails during login, enabling privilege escalation and information disclosure.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

LPE

Weakness Enumeration

CWE-1259

Related Identifiers

CVE-2025-56676

Affected Products

Zender

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-56676 · Security Note
• https://osv.dev/vulnerability/CVE-2025-56676 · Vendor Advisory
• https://darklotus.medium.com/cve-2025-56676-critical-vulnerability-in-zender-gateway-allows-account-takeover-2b5bcb50c762 · Note
• https://t.me/CVEtracker/33742 · Telegram Post
• https://codecanyon.net/item/zender-android-mobile-devices-as-sms-gateway-saas-platform/26594230 · Note
• https://twitter.com/CVEnew/status/2003567325090398565 · Twitter Post
• https://previews.titansystems.ph/zender/dashboard/auth · Note