PT-2025-42477 · Webmin+1 · Webmin+1

Published 2025-10-11 · Updated 2025-11-21 · CVE-2025-61541

Positive Technologies (AI Summary)

CVSS v2.0

8.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:C

Name of the Vulnerable Software and Affected Versions Webmin version 2.510

Description Webmin version 2.510 has a flaw in the password reset functionality (forgot send.cgi). The reset link sent to users is created using the HTTP Host header through the get webmin email url() function. An attacker can manipulate the Host header to insert a malicious domain into the reset email. If a user clicks the altered link, the attacker can intercept the reset token and take complete control of the account. The vulnerable component is the construction of the reset link using the HTTP Host header.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

BDU:2025-14429

CVE-2025-61541

Affected Products

Red Os

Webmin

References · 14

• 🔥 https://github.com/bugdotexe/Vulnerability-Research/tree/main/CVE-2025-61541 · Exploit
• https://osv.dev/vulnerability/CVE-2025-61541 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-61541 · Security Note
• https://bdu.fstec.ru/vul/2025-14429 · Security Note
• https://github.com/webmin/webmin · Note
• https://abf.rosa.ru/advisories/ROSA-SA-2026-3208 · Note
• https://t.me/avleonovcom/1609 · Telegram Post
• https://t.me/CVEtracker/35097 · Telegram Post
• http://webmin.com · Note
• https://twitter.com/CVEnew/status/1978932574350393431 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1978910600689332608 · Twitter Post
• https://t.me/cveNotify/139702 · Telegram Post
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti/uyazvimost-webmin-cve-2025-61541 · Note
• https://redos.red-soft.ru/support/secure · Note